cbcvebase.
CVE-2023-50917
published 2023-12-15

CVE-2023-50917: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo…

PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
38.26%
98.4th percentile
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.

Affected

1 ranges
VendorProductVersion rangeFixed in
mjdmmajordomo< 2023-11-152023-11-15

Detection & IOCsextracted from sources · hover to see the quote

path/modules/thumb/thumb.php
url{{BaseURL}}/modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B
yara
regex: uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)
  • Exploit targets the `transport` parameter in thumb.php with shell metacharacters (e.g., `||`) to inject OS commands. Look for URL-encoded pipe characters (%7C%7C) in requests to /modules/thumb/thumb.php.
  • Unauthenticated GET requests to /modules/thumb/thumb.php with both `debug=1` and a `transport` parameter containing shell metacharacters are indicative of exploitation attempts.
  • Response body containing `uid=` and `gid=` output from the `id` command confirms successful exploitation.
  • MajorDoMo instances can be fingerprinted via Shodan favicon hash 1903390397 or FOFA queries for app="MajordomoSL" / app="majordomosl" / icon_hash=1903390397.
  • ·Vulnerability only affects MajorDoMo versions before commit 0662e5e. Patched versions (0662e5e and newer) are not vulnerable.
  • ·This CVE is unrelated to the Majordomo mailing-list manager; ensure detections are scoped to the MajorDoMo home-automation platform (mjdm/majordomo) to avoid false positives.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.