PT-2023-7967 · Majordomo · Majordomo

Balgogan · Published 2023-10-28 · Updated 2025-12-23 · CVE-2023-50917

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions MajorDoMo version before 0662e5e

Description The issue is related to the thumb.php module in MajorDoMo, which allows command execution via shell metacharacters. This can be exploited by a remote attacker to execute arbitrary commands. The vulnerability is unrelated to the Majordomo mailing-list manager. Attackers could compromise physical security systems, gain unauthorized access to surveillance cameras, and even hijack other connected IoT devices.

Recommendations For MajorDoMo version before 0662e5e, consider disabling the thumb.php module until a patch is available to prevent command execution via shell metacharacters. Restrict access to the thumb module to minimize the risk of exploitation. Avoid using the thumb.php module in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

BDU:2023-09051

CVE-2023-50917

Affected Products

Majordomo

References · 24

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/majordomo_cmd_inject_cve_2023_50917.rb · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2023-50917 · Exploit
• https://github.com/sergejey/majordomo/commit/0662e5ebfb133445ff6154b69c61019357092178 · Patch
• https://github.com/sergejey/majordomo/commit/3ec3ffb863ea3c2661ab27d398776c551f4daaac · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-50917 · Security Note
• https://bdu.fstec.ru/vul/2023-09051 · Security Note
• https://osv.dev/vulnerability/CVE-2023-50917 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/9620 · Telegram Post
• https://twitter.com/ksg93rd/status/1737618169567777045 · Twitter Post
• https://twitter.com/fridaysecurity/status/1737380453231755490 · Twitter Post
• https://twitter.com/Dinosn/status/1737401481823649823 · Twitter Post
• http://packetstormsecurity.com/files/176273/MajorDoMo-Remote-Code-Execution.html · Note
• https://twitter.com/DhiyaneshDK/status/1746571331510898960 · Twitter Post
• https://twitter.com/CVEnew/status/1735946027868586016 · Twitter Post
• https://t.me/cvenotify/63778 · Telegram Post