CVE-2023-50917
published 2023-12-15CVE-2023-50917: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo…
PriorityP188critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
38.26%
98.4th percentile
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| mjdm | majordomo | < 2023-11-15 | 2023-11-15 |
Detection & IOCsextracted from sources · hover to see the quote
url{{BaseURL}}/modules/thumb/thumb.php?url=cnRzcDovL2EK&debug=1&transport=%7C%7C+%28echo+%27%5BS%5D%27%3B+id%3B+echo+%27%5BE%5D%27%29%23%3B↗
yara↗
regex: uid=([0-9(a-z)]+) gid=([0-9(a-z)]+)
- →Exploit targets the `transport` parameter in thumb.php with shell metacharacters (e.g., `||`) to inject OS commands. Look for URL-encoded pipe characters (%7C%7C) in requests to /modules/thumb/thumb.php. ↗
- →Unauthenticated GET requests to /modules/thumb/thumb.php with both `debug=1` and a `transport` parameter containing shell metacharacters are indicative of exploitation attempts. ↗
- →Response body containing `uid=` and `gid=` output from the `id` command confirms successful exploitation. ↗
- →MajorDoMo instances can be fingerprinted via Shodan favicon hash 1903390397 or FOFA queries for app="MajordomoSL" / app="majordomosl" / icon_hash=1903390397. ↗
- ·Vulnerability only affects MajorDoMo versions before commit 0662e5e. Patched versions (0662e5e and newer) are not vulnerable. ↗
- ·This CVE is unrelated to the Majordomo mailing-list manager; ensure detections are scoped to the MajorDoMo home-automation platform (mjdm/majordomo) to avoid false positives. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-3pqp-qx7r-vppf: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb
ghsa_unreviewed·2023-12-15
CVE-2023-50917 [CRITICAL] CWE-77 GHSA-3pqp-qx7r-vppf: MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
VulnCheck
mjdm majordomo Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2023·CVSS 9.8
CVE-2023-50917 [CRITICAL] mjdm majordomo Improper Neutralization of Special Elements used in a Command ('Command Injection')
mjdm majordomo Improper Neutralization of Special Elements used in a Command ('Command Injection')
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
Affected: mjdm majordomo
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2023-50917&date=2025-10-17; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2023-50917&date=2025-10-18; https://api.vulncheck.com/v3/index/vulncheck-canaries?cve=CVE-2023-50917&date=2025-10-19; https://api.vulncheck.com/v3/index/vulncheck
No detection rules found.
Metasploit
MajorDoMo Command Injection
metasploit
MajorDoMo Command Injection
MajorDoMo Command Injection
This module exploits a command injection vulnerability in MajorDoMo versions before 0662e5e.
Nuclei
MajorDoMo thumb.php - OS Command Injection
nuclei·CVSS 9.8
CVE-2023-50917 [CRITICAL] MajorDoMo thumb.php - OS Command Injection
MajorDoMo thumb.php - OS Command Injection
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
Template:
id: CVE-2023-50917
info:
name: MajorDoMo thumb.php - OS Command Injection
author: DhiyaneshDK
severity: critical
description: |
MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. NOTE: this is unrelated to the Majordomo mailing-list manager.
impact: |
Unauthenticated attackers can execute arbitrary OS commands via shell metacharacters in the thumb.php transport parameter, potentially compromising the entire system.
remediation: |
Update MajorDoMo to a version newer than commit 0662e5e which address
No writeups or analysis indexed.
http://packetstormsecurity.com/files/176273/MajorDoMo-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/176669/MajorDoMo-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2023/Dec/19https://github.com/sergejey/majordomo/commit/0662e5ebfb133445ff6154b69c61019357092178https://github.com/sergejey/majordomo/commit/3ec3ffb863ea3c2661ab27d398776c551f4daaachttp://packetstormsecurity.com/files/176273/MajorDoMo-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/176669/MajorDoMo-Command-Injection.htmlhttp://seclists.org/fulldisclosure/2023/Dec/19https://github.com/sergejey/majordomo/commit/0662e5ebfb133445ff6154b69c61019357092178https://github.com/sergejey/majordomo/commit/3ec3ffb863ea3c2661ab27d398776c551f4daaac
2023-12-15
Published
Exploited in the wild