Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

[0day-rubbish] CaptureBites MetaServer Anonymous WCF SOAP workflow leading to RunPrograms code execution (9.8)

Full Disclosure ()1 · 1 read
Read at seclists.org
Part of a story covered by 2 sources0day Rubbish Research Team discloses two same-day flaws: unauthenticated SYSTEM execution in CaptureBites MetaServer and root command injection in Opengear NGCS 25.11.8Merged summary & timeline
AI summary · grok-4.7Summaries by Vani AI

Unauthenticated attackers can trigger CaptureBites MetaServer RunPrograms execution as SYSTEM through an anonymous WCF SOAP workflow.

0day Rubbish Research Team disclosed an unauthenticated code-execution flaw in CaptureBites MetaServer. An anonymous WCF SOAP workflow can invoke RunPrograms (CWE-306), producing arbitrary command execution as NT AUTHORITY\SYSTEM on the MetaServer host. The stated CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The mailing-list post points to a full technical analysis and reproducible proof-of-concept but names no CVE and does not claim in-the-wild use.

Key facts
  • CaptureBites MetaServer; no build version given in the post.
  • Anonymous WCF SOAP workflow reaches the RunPrograms action.
  • Unauthenticated command execution as NT AUTHORITY\SYSTEM; CVSS 9.8.
  • Public PoC claimed; no CVE or observed exploitation stated.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1190 Exploit Public-Facing ApplicationT1059 Command and Scripting Interpreter
Tags
capturebitesmetaserverwcfsoaprceunauthenticatedpoc
Vendors
CaptureBites
Products
MetaServer
Organizations
0day Rubbish Research Team

From the original article

Posted by disclosure via Fulldisclosure on Sep 22 0day Rubbish Research Team is publicly disclosing a vulnerability in CaptureBites MetaServer. Type: Anonymous WCF SOAP workflow leading to RunPrograms code execution (CWE-306) CVSS: 9.

Full Disclosure

seclists.org

Read the full article at Full Disclosure

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.