kemendagri.go.id vulnerability
by marlanwg - Thursday October 15, 2026 at 01:48 PM
DarkForums Members
Members
Posts: 98
Threads: 27
Joined: Oct 2025
Reputation: 0

#1
15-10-26, 01:48 PM (This post was last modified: 15-10-26, 02:08 PM by marlanwg.)
Kemendagri vulnerability 
BPSDM Kemendagri / SID Kemendagri / Ruijie / MinIO / Nextcloud / MariaDB
13 findings — 4 CRITICAL, 5 HIGH, 2 MEDIUM, 2 LOW


FINDINGS SUMMARY
  • CRITICAL — Pre-auth root RCE on Ruijie NBS3100-24GT4SFP-P switch (10.10.15.4) via /cgi-bin/luci/api/auth checkNet
  • CRITICAL — SSRF via server-side JavaScript (Zabbix webhook) → pivot to internal management plane
  • CRITICAL — Zabbix host already compromised by another actor: global-script persistence + S3 C2
  • CRITICAL — Default credentials / broken authentication on Zabbix 7.0.6
  • HIGH — Unauthenticated MinIO Console SSRF to loopback-only S3 admin API + unlimited brute-force oracle
  • HIGH — Unauthenticated SSRF in MinIO Console /api/v1/list-external-buckets (attacker-controlled targetURL)
  • HIGH — Nextcloud 25.0.2 lacks brute-force protection on WebDAV basic auth (CVE-2023-32319)
  • HIGH — Credential reuse → authenticated takeover of adjacent Ruijie devices
  • HIGH — Adminer 4.8.1 exposed to the internet on shared SID origin (pre-auth PostgreSQL + SSRF)
  • MEDIUM — Nextcloud username enumeration via public profile endpoint /u/<userId>
  • MEDIUM — SID origin 103.245.225.58 accepts arbitrary Host headers (Cloudflare bypass)
  • LOW — Repository/deployment files exposed under /home/ (CodeIgniter stack disclosure + default template credentials)
  • LOW — MariaDB 10.11.18 pre-auth username enumeration (103.27.206.204:3306)


1. CRITICAL — Pre-auth root RCE on Ruijie NBS3100-24GT4SFP-P switch (10.10.15.4)
Endpoint:
POST /cgi-bin/luci/api/auth
— JSON-RPC method
checkNet
, parameter
params.host
Device: Ruijie NBS3100-24GT4SFP-P, ReyeeOS 1.72.2130
Impact: Root shell, /etc/shadow, MQTT cloud secret, network configuration, credential reuse

The internal Ruijie NBS3100-24GT4SFP-P managed switch (10.10.15.4, ReyeeOS 1.72.2130) is vulnerable to pre-authentication command injection in the
checkNet
method at the
/cgi-bin/luci/api/auth
endpoint. The
params.host
value is interpolated into a shell command. Command substitution is honored (
$(...)
and backticks), while
;
and
|
are neutralized because the value is placed inside quotes. Command output is written to the LuCI webroot (/www) and then read back over HTTP, resulting in a root shell
uid=0(root)
, the complete contents of /etc/shadow (MD5-crypt hashes for root and admin), the device's cloud/MQTT secret, and network configuration. The recovered admin hash was cracked to NOCbpsdm123 — a credential belonging to a leaked AI agent, confirming credential reuse. The vulnerability was exploited end-to-end through the Zabbix webhook SSRF (finding 361) from the Zabbix server. Two sibling switches, 192.168.7.3 (ReyeeOS 2.390.2.1929) and 10.10.11.3 (ReyeeOS 2.390.1.1823), have already been patched (host validation returned: "host illegal").

PoC:
Show Content


2. CRITICAL — SSRF via server-side JavaScript (Zabbix webhook) → pivot to internal management plane
Endpoint: Zabbix global webhook script (type=5) via
script.execute
Impact: Server-side SSRF to FortiGate, Ruijie switches, loopback, and the internet

With the default Super Admin API session Admin/zabbix, a Zabbix global webhook script (type=5) executes server-side JavaScript ON the Zabbix server, and its return value is passed back through
script.execute
without an error. Using the available
HttpRequest
object, full SSRF was confirmed: the Zabbix server can reach the internal FortiGate admin/SSL-VPN portal (https://172.16.20.1 → HTTP 200 login page), three internal Ruijie switches (http://192.168.7.3, http://10.10.15.4, http://10.10.11.3 → HTTP 200 RGOS web UI redirecting to /cgi-bin/luci/), the loopback Zabbix frontend (http://127.0.0.1:8080 → 200, len 3944), and the external internet (https://example.com → 200; C2 host pct-wp.s3.amazonaws.com → 403). A POST to the FortiGate login endpoint /logincheck produces a working authentication oracle (first response character: 0 = login failed, 2 = lockout); the leaked credentials admin/nocbpsdm and admin/NOCbpsdm123 failed, and the admin account was locked out. The attacker-planted webhook script (script 582, mt7wh_31518) is precisely a server-side SSRF probe targeting the MikroTik RouterOS API. This converts the default-credential Zabbix compromise into verified server-side reachability to the internal network management plane. Note: the JS object
Socket
is undefined, so raw TCP targets (MikroTik RouterOS binary API 8728) can only be probed over HTTP, which times out.

PoC:
Show Content


3. CRITICAL — Compromised host: malicious global-script persistence + C2
Host: Zabbix server at http://43.229.20.137:8080
Impact: Malware distribution, internal pivoting, active C2 (S3 + payload downloader)

The Zabbix monitoring server behind http://43.229.20.137:8080 has already been weaponized by a previous actor: global scripts were planted to deliver bash reverse-shell/stagers with S3-based C2 (pct-wp.s3.amazonaws.com, c2w-dev-app-vcf.s3.amazonaws.com) and an external payload downloader (
/tmp/.zb app-zabbix
from 80.87.206.86 / 85.137.54.178). Accessible using the same default Super Admin credentials (Admin/zabbix), this server is being used as a malware distribution/internal pivot point; the stager script "MyScripttest" is recreated approximately every four hours, indicating active automation.

PoC:
Show Content


4. CRITICAL — Default Credentials / Broken Authentication (Zabbix 7.0.6)
Endpoint: http://43.229.20.137:8080/api_jsonrpc.php
Host: zabbix.bpsdmkemendagri.id (BPSDM Kemendagri)
Impact: Super Admin API session, internal host enumeration, script execution on monitored hosts

The Zabbix 7.0.6 monitoring frontend at http://43.229.20.137:8080 (zabbix.bpsdmkemendagri.id, BPSDM Kemendagri) accepts the vendor's default credentials Admin/zabbix, granting a Super Admin API session. This session can enumerate monitored internal hosts (FortiGate firewall, Ruijie switches, routers) and enables full control of the monitoring server (script execution on monitored hosts, configuration changes), creating critical exposure of the internal network management plane.

PoC:
Show Content


5. HIGH — Unauthenticated MinIO Console SSRF to loopback-only S3 admin API
Endpoint: https://103.245.225.197 — POST /api/v1/list-external-buckets
Impact: Internal account enumeration, unlimited brute-force oracle, arbitrary-path GET proxy to loopback MinIO

Unauthenticated SSRF in the internet-exposed MinIO Console at https://103.245.225.197 (POST /api/v1/list-external-buckets, which causes the server to fetch http://<targetURL>/minio/admin/v3/accountinfo) can be weaponized from a port-scanning oracle into a real credential primitive: because the endpoint signs the request using SigV4 with the attacker-supplied accessKey/secretKey before sending it to the loopback MinIO server (127.0.0.1:9000, not externally exposed), the server response distinguishes existing access keys from nonexistent ones and validates guessed secrets. This confirms that the access key "admin" EXISTS on the loopback object-storage admin account, giving an unauthenticated internet attacker: (1) internal account enumeration, (2) an unlimited online password-guessing oracle with no rate limit against the internal object-storage root account, and (3) through a second unauthenticated endpoint (GET /api/v1/download-shared-object/<base64url>, with the host locked to 127.0.0.1:9000 but the path fully attacker-controlled), an arbitrary-path request proxy to the loopback-only MinIO server. A list of 60,001 candidate passwords (rockyou entries of at least eight characters + 10k common passwords) did not recover the secret, and the loopback host exposes no other services (only 22/80/443/9000/9001 open), so object-data disclosure or admin takeover was NOT achieved. The confirmed impact is a network-boundary bypass, disclosure of a valid internal admin account name, and an unlimited brute-force oracle against an internal-only service.

PoC:
Show Content


6. HIGH — Unauthenticated SSRF in MinIO Console /api/v1/list-external-buckets
Endpoint: https://103.245.225.197 — POST /api/v1/list-external-buckets (attacker-controlled targetURL)
Impact: Network-boundary bypass, internal port scanning, access to loopback services

The internet-exposed MinIO Console at https://103.245.225.197 exposes POST /api/v1/list-external-buckets without authentication. The endpoint accepts attacker-supplied S3 credentials and targetURL (host:port), then makes a server-side request to http(s)://<targetURL>/minio/admin/v3/accountinfo, returning the fetched response (or an error containing the upstream body) to the caller. Without a session or cookie, an attacker can force the server to send requests to arbitrary hosts and ports: it reaches loopback-only services (the nginx 404 page from 127.0.0.1:80 is reflected verbatim, as are responses from the MinIO server API at 127.0.0.1:9000 and the console backend at 127.0.0.1:9001), confirms external egress (the example.com HTML is reflected), and behaves as a port scanner (connection refused/reset/timeout versus open). The MinIO server API at 127.0.0.1:9000 is NOT exposed through the nginx frontend, making this a genuine network-boundary bypass combined with a missing-authorization flaw in an administrative feature.

PoC:
Show Content


7. HIGH — Nextcloud 25.0.2: no brute-force protection on WebDAV basic auth (CVE-2023-32319)
Host: cloud-adwil.kemendagri.go.id
Version: Nextcloud 25.0.2 (end-of-life)
Impact: Unlimited online password guessing, potential account takeover

The end-of-life Nextcloud 25.0.2 instance at cloud-adwil.kemendagri.go.id does not rate-limit failed WebDAV basic-auth requests: 105 consecutive incorrect password attempts using the non-email username "brute_test_acct" all returned HTTP 401 without 429/Retry-After, and the account/IP remained unblocked afterward. The sibling instances drive-dwp (30.0.6) and drive-pkk (30.0.2) return HTTP 429 for the same requests, demonstrating that the protection exists but is missing on this host. This matches CVE-2023-32319 ("Missing brute-force protection on the WebDAV endpoints via the basic auth header ... when the supplied username is not an email address", fixed in 25.0.5/26.0.0); CVE-2023-32320 (limit bypass via parallel requests, fixed in 25.0.7) also applies to the same host. Impact: an unauthenticated attacker can perform unlimited online password guessing against Nextcloud accounts, including admin accounts, potentially enabling account takeover and access to synchronized files. Common password lists and approximately 165 curated words were rejected for admin/administrator/nextcloud/root/etc., so no credentials were actually cracked, but attempts are not rate-limited.

PoC:
Show Content


8. HIGH — Credential Reuse: authenticated takeover of adjacent network devices
Source: Root shell on switch 10.10.15.4 (finding 1)
Credentials: NOCbpsdm123 (cracked from /etc/shadow, also stored as an SNMP read-write community)
Targets: 10.10.15.8, 10.10.15.9, 192.168.7.3, 10.10.11.3

The root shell on the pre-auth-RCE switch 10.10.15.4 (finding 382) revealed the device admin password NOCbpsdm123 (cracked from /etc/shadow and also stored as an SNMP read-write community). Using the switch's embedded Linux shell as a jump host, the same password yielded valid authenticated administrator sessions on four adjacent Ruijie devices on the internal management network: 10.10.15.8, 10.10.15.9, 192.168.7.3, and 10.10.11.3. The latter two had previously been assessed as patched against RCE but remain fully susceptible to takeover through credential reuse. Ruijie eweb login encrypts passwords using a per-device Gibberish-AES key scraped from each device's own login page, so reuse is not prevented by any per-device secret. Every successful login returned a live session (sid + token) and device serial number, demonstrating administrative control over the management plane.

PoC:
Show Content


9. HIGH — Adminer 4.8.1 exposed to the internet on shared SID origin (pre-auth PostgreSQL + SSRF)
Origin: 103.245.225.58 — /admin/ (all Host headers)
Impact: Pre-auth access to local PostgreSQL, SSRF to unprivileged ports

The shared SID origin 103.245.225.58 serves an Adminer 4.8.1 database management interface at /admin/ for EVERY Host header (all ~150 <kabupaten>.sipd.kemendagri.go.id names and even random ones), without IP restrictions. Although PHP lacks MySQL extensions, Adminer's PostgreSQL driver works and reaches the LOCAL PostgreSQL server (Unix-socket peer authentication, with the PHP process running as OS user "apache"), which is otherwise not exposed, and its Elasticsearch driver provides a pre-auth SSRF primitive to unprivileged ports. This turns an unauthenticated public web path into an entry point to the application database tier.

PoC:
Show Content


10. MEDIUM — Nextcloud username enumeration via public profile endpoint /u/<userId>
Host: cloud-adwil.kemendagri.go.id
Impact: Disclosure of valid account lists, department/organizational structure

The Nextcloud 25.0.2 EOL instance at cloud-adwil.kemendagri.go.id exposes an unauthenticated username-enumeration oracle: GET /u/<userId> returns a public profile page (HTTP 200, embedding the base64-encoded core-profileParameters initial state with userId/displayname) for VALID accounts, but falls back to the login page for nonexistent accounts. Without any credentials, the valid accounts 'admin', 'backup', and 'keuangan' were confirmed (with display names 'admin', 'Data Bagian Perencanaan', and 'Bagian Keuangan'), revealing department/organizational structure and providing an accurate unauthenticated list of valid accounts for targeted password guessing (non-email usernames ignored by this host's CVE-2023-32319 throttling path). This is a real, verified information-disclosure weakness; it does not independently grant access.

PoC:
Show Content


11. MEDIUM — SID origin 103.245.225.58 accepts arbitrary Host headers (Cloudflare bypass)
Origin: 103.245.225.58
Impact: CDN/WAF bypass, direct access to the entire ~150-host cluster

The shared SID Laravel application is served directly from origin 103.245.225.58 and derives the tenant/region from the FIRST LABEL of the HTTP Host header, ignoring the rest of the hostname: any hostname whose first label is a recognized region ('sipd', or a regency such as 'bandung') receives HTTP 200 even when the remainder is attacker-controlled (e.g. Host: sipd.kemendagri.go.id.evil.com -> 200/20836B; Host: bandung.sipd.kemendagri.go.id.attacker.net -> 200/21160B). The public FQDN sipd.kemendagri.go.id returns 403 through Cloudflare, so the origin provides a direct CDN/WAF bypass to the entire ~150-host cluster. The homepage also leaks an internal IP through console.log("172.24.4.36"). Separately, note that the login boundary itself could not be exploited: the JS-built login route POST /pusat/main/<apel>/login returns 404 on this origin, and the only actual action route /{seg}/main returns a constant 500, so no SQLi/auth-bypass evidence was obtained there.

PoC:
Show Content


12. LOW — Repository/deployment files exposed under /home/ (CodeIgniter stack + default template credentials disclosure)
Host: assessment.kemendagri.go.id
Impact: Stack disclosure, application provenance, default template credentials

The web root of assessment.kemendagri.go.id serves CodeIgniter application source-repository metadata files at /home/README.md (200), /home/composer.json (200), /home/CONTRIBUTING.md (200), and /home/.editorconfig (200). README.md contains the original template installation guide and discloses the framework (CodeIgniter 3 + SB Admin 2), the application's origin (the "Aplikasi Penjualan" POS template), and the template's DEFAULT LOGIN CREDENTIALS (admin: nugrohoff / pwd_nugroho, kasir: KSR58 / pwd_fakhrul). These defaults were tested against /home/login/proses_login and did NOT authenticate (both returned 303 -> /home/ with "Salah!"), but the disclosure still exposes the stack, application provenance, and credential material that could be reused in password-reuse attacks.

PoC:
Show Content


13. LOW — MariaDB 10.11.18 pre-auth username enumeration (103.27.206.204:3306)
Host: 103.27.206.204:3306
Version: MariaDB 10.11.18
Impact: Pre-authentication enumeration of valid database users

The internet-exposed MariaDB 10.11.18 service at 103.27.206.204:3306 discloses valid account names before authentication: failed logins for users that EXIST return error 1698 ("Access denied for user 'x'@Host"), while nonexistent users return error 1045 ("... (using password: YES)"). This provides an unauthenticated remote oracle for enumerating valid database users, narrowing subsequent credential brute-force attempts. No valid password was found (1,152 common username/password pairs were rejected), but the account list was exposed.

PoC:
Show Content


If you get profit don't forget me. 4 CRITICAL, 5 HIGH, 2 MEDIUM, 2 LOW.
If this is useful, please just comment.
If this is useful please just comment
Reply
DarkForums Members
Members
Posts: 98
Threads: 27
Joined: Oct 2025
Reputation: 0

#2
15-10-26, 05:44 PM
(15-10-26, 01:48 PM)marlanwg Wrote:
Kemendagri vulnerability 
BPSDM Kemendagri / SID Kemendagri / Ruijie / MinIO / Nextcloud / MariaDB
13 findings — 4 CRITICAL, 5 HIGH, 2 MEDIUM, 2 LOW


FINDINGS SUMMARY
  • CRITICAL — Pre-auth root RCE on Ruijie NBS3100-24GT4SFP-P switch (10.10.15.4) via /cgi-bin/luci/api/auth checkNet
  • CRITICAL — SSRF via server-side JavaScript (Zabbix webhook) → pivot to internal management plane
  • CRITICAL — Zabbix host already compromised by another actor: global-script persistence + S3 C2
  • CRITICAL — Default credentials / broken authentication on Zabbix 7.0.6
  • HIGH — Unauthenticated MinIO Console SSRF to loopback-only S3 admin API + unlimited brute-force oracle
  • HIGH — Unauthenticated SSRF in MinIO Console /api/v1/list-external-buckets (attacker-controlled targetURL)
  • HIGH — Nextcloud 25.0.2 lacks brute-force protection on WebDAV basic auth (CVE-2023-32319)
  • HIGH — Credential reuse → authenticated takeover of adjacent Ruijie devices
  • HIGH — Adminer 4.8.1 exposed to the internet on shared SID origin (pre-auth PostgreSQL + SSRF)
  • MEDIUM — Nextcloud username enumeration via public profile endpoint /u/<userId>
  • MEDIUM — SID origin 103.245.225.58 accepts arbitrary Host headers (Cloudflare bypass)
  • LOW — Repository/deployment files exposed under /home/ (CodeIgniter stack disclosure + default template credentials)
  • LOW — MariaDB 10.11.18 pre-auth username enumeration (103.27.206.204:3306)


1. CRITICAL — Pre-auth root RCE on Ruijie NBS3100-24GT4SFP-P switch (10.10.15.4)
Endpoint:
POST /cgi-bin/luci/api/auth
— JSON-RPC method
checkNet
, parameter
params.host
Device: Ruijie NBS3100-24GT4SFP-P, ReyeeOS 1.72.2130
Impact: Root shell, /etc/shadow, MQTT cloud secret, network configuration, credential reuse

The internal Ruijie NBS3100-24GT4SFP-P managed switch (10.10.15.4, ReyeeOS 1.72.2130) is vulnerable to pre-authentication command injection in the
checkNet
method at the
/cgi-bin/luci/api/auth
endpoint. The
params.host
value is interpolated into a shell command. Command substitution is honored (
$(...)
and backticks), while
;
and
|
are neutralized because the value is placed inside quotes. Command output is written to the LuCI webroot (/www) and then read back over HTTP, resulting in a root shell
uid=0(root)
, the complete contents of /etc/shadow (MD5-crypt hashes for root and admin), the device's cloud/MQTT secret, and network configuration. The recovered admin hash was cracked to NOCbpsdm123 — a credential belonging to a leaked AI agent, confirming credential reuse. The vulnerability was exploited end-to-end through the Zabbix webhook SSRF (finding 361) from the Zabbix server. Two sibling switches, 192.168.7.3 (ReyeeOS 2.390.2.1929) and 10.10.11.3 (ReyeeOS 2.390.1.1823), have already been patched (host validation returned: "host illegal").

PoC:
Show Content


2. CRITICAL — SSRF via server-side JavaScript (Zabbix webhook) → pivot to internal management plane
Endpoint: Zabbix global webhook script (type=5) via
script.execute
Impact: Server-side SSRF to FortiGate, Ruijie switches, loopback, and the internet

With the default Super Admin API session Admin/zabbix, a Zabbix global webhook script (type=5) executes server-side JavaScript ON the Zabbix server, and its return value is passed back through
script.execute
without an error. Using the available
HttpRequest
object, full SSRF was confirmed: the Zabbix server can reach the internal FortiGate admin/SSL-VPN portal (https://172.16.20.1 → HTTP 200 login page), three internal Ruijie switches (http://192.168.7.3, http://10.10.15.4, http://10.10.11.3 → HTTP 200 RGOS web UI redirecting to /cgi-bin/luci/), the loopback Zabbix frontend (http://127.0.0.1:8080 → 200, len 3944), and the external internet (https://example.com → 200; C2 host pct-wp.s3.amazonaws.com → 403). A POST to the FortiGate login endpoint /logincheck produces a working authentication oracle (first response character: 0 = login failed, 2 = lockout); the leaked credentials admin/nocbpsdm and admin/NOCbpsdm123 failed, and the admin account was locked out. The attacker-planted webhook script (script 582, mt7wh_31518) is precisely a server-side SSRF probe targeting the MikroTik RouterOS API. This converts the default-credential Zabbix compromise into verified server-side reachability to the internal network management plane. Note: the JS object
Socket
is undefined, so raw TCP targets (MikroTik RouterOS binary API 8728) can only be probed over HTTP, which times out.

PoC:
Show Content


3. CRITICAL — Compromised host: malicious global-script persistence + C2
Host: Zabbix server at http://43.229.20.137:8080
Impact: Malware distribution, internal pivoting, active C2 (S3 + payload downloader)

The Zabbix monitoring server behind http://43.229.20.137:8080 has already been weaponized by a previous actor: global scripts were planted to deliver bash reverse-shell/stagers with S3-based C2 (pct-wp.s3.amazonaws.com, c2w-dev-app-vcf.s3.amazonaws.com) and an external payload downloader (
/tmp/.zb app-zabbix
from 80.87.206.86 / 85.137.54.178). Accessible using the same default Super Admin credentials (Admin/zabbix), this server is being used as a malware distribution/internal pivot point; the stager script "MyScripttest" is recreated approximately every four hours, indicating active automation.

PoC:
Show Content


4. CRITICAL — Default Credentials / Broken Authentication (Zabbix 7.0.6)
Endpoint: http://43.229.20.137:8080/api_jsonrpc.php
Host: zabbix.bpsdmkemendagri.id (BPSDM Kemendagri)
Impact: Super Admin API session, internal host enumeration, script execution on monitored hosts

The Zabbix 7.0.6 monitoring frontend at http://43.229.20.137:8080 (zabbix.bpsdmkemendagri.id, BPSDM Kemendagri) accepts the vendor's default credentials Admin/zabbix, granting a Super Admin API session. This session can enumerate monitored internal hosts (FortiGate firewall, Ruijie switches, routers) and enables full control of the monitoring server (script execution on monitored hosts, configuration changes), creating critical exposure of the internal network management plane.

PoC:
Show Content


5. HIGH — Unauthenticated MinIO Console SSRF to loopback-only S3 admin API
Endpoint: https://103.245.225.197 — POST /api/v1/list-external-buckets
Impact: Internal account enumeration, unlimited brute-force oracle, arbitrary-path GET proxy to loopback MinIO

Unauthenticated SSRF in the internet-exposed MinIO Console at https://103.245.225.197 (POST /api/v1/list-external-buckets, which causes the server to fetch http://<targetURL>/minio/admin/v3/accountinfo) can be weaponized from a port-scanning oracle into a real credential primitive: because the endpoint signs the request using SigV4 with the attacker-supplied accessKey/secretKey before sending it to the loopback MinIO server (127.0.0.1:9000, not externally exposed), the server response distinguishes existing access keys from nonexistent ones and validates guessed secrets. This confirms that the access key "admin" EXISTS on the loopback object-storage admin account, giving an unauthenticated internet attacker: (1) internal account enumeration, (2) an unlimited online password-guessing oracle with no rate limit against the internal object-storage root account, and (3) through a second unauthenticated endpoint (GET /api/v1/download-shared-object/<base64url>, with the host locked to 127.0.0.1:9000 but the path fully attacker-controlled), an arbitrary-path request proxy to the loopback-only MinIO server. A list of 60,001 candidate passwords (rockyou entries of at least eight characters + 10k common passwords) did not recover the secret, and the loopback host exposes no other services (only 22/80/443/9000/9001 open), so object-data disclosure or admin takeover was NOT achieved. The confirmed impact is a network-boundary bypass, disclosure of a valid internal admin account name, and an unlimited brute-force oracle against an internal-only service.

PoC:
Show Content


6. HIGH — Unauthenticated SSRF in MinIO Console /api/v1/list-external-buckets
Endpoint: https://103.245.225.197 — POST /api/v1/list-external-buckets (attacker-controlled targetURL)
Impact: Network-boundary bypass, internal port scanning, access to loopback services

The internet-exposed MinIO Console at https://103.245.225.197 exposes POST /api/v1/list-external-buckets without authentication. The endpoint accepts attacker-supplied S3 credentials and targetURL (host:port), then makes a server-side request to http(s)://<targetURL>/minio/admin/v3/accountinfo, returning the fetched response (or an error containing the upstream body) to the caller. Without a session or cookie, an attacker can force the server to send requests to arbitrary hosts and ports: it reaches loopback-only services (the nginx 404 page from 127.0.0.1:80 is reflected verbatim, as are responses from the MinIO server API at 127.0.0.1:9000 and the console backend at 127.0.0.1:9001), confirms external egress (the example.com HTML is reflected), and behaves as a port scanner (connection refused/reset/timeout versus open). The MinIO server API at 127.0.0.1:9000 is NOT exposed through the nginx frontend, making this a genuine network-boundary bypass combined with a missing-authorization flaw in an administrative feature.

PoC:
Show Content


7. HIGH — Nextcloud 25.0.2: no brute-force protection on WebDAV basic auth (CVE-2023-32319)
Host: cloud-adwil.kemendagri.go.id
Version: Nextcloud 25.0.2 (end-of-life)
Impact: Unlimited online password guessing, potential account takeover

The end-of-life Nextcloud 25.0.2 instance at cloud-adwil.kemendagri.go.id does not rate-limit failed WebDAV basic-auth requests: 105 consecutive incorrect password attempts using the non-email username "brute_test_acct" all returned HTTP 401 without 429/Retry-After, and the account/IP remained unblocked afterward. The sibling instances drive-dwp (30.0.6) and drive-pkk (30.0.2) return HTTP 429 for the same requests, demonstrating that the protection exists but is missing on this host. This matches CVE-2023-32319 ("Missing brute-force protection on the WebDAV endpoints via the basic auth header ... when the supplied username is not an email address", fixed in 25.0.5/26.0.0); CVE-2023-32320 (limit bypass via parallel requests, fixed in 25.0.7) also applies to the same host. Impact: an unauthenticated attacker can perform unlimited online password guessing against Nextcloud accounts, including admin accounts, potentially enabling account takeover and access to synchronized files. Common password lists and approximately 165 curated words were rejected for admin/administrator/nextcloud/root/etc., so no credentials were actually cracked, but attempts are not rate-limited.

PoC:
Show Content


8. HIGH — Credential Reuse: authenticated takeover of adjacent network devices
Source: Root shell on switch 10.10.15.4 (finding 1)
Credentials: NOCbpsdm123 (cracked from /etc/shadow, also stored as an SNMP read-write community)
Targets: 10.10.15.8, 10.10.15.9, 192.168.7.3, 10.10.11.3

The root shell on the pre-auth-RCE switch 10.10.15.4 (finding 382) revealed the device admin password NOCbpsdm123 (cracked from /etc/shadow and also stored as an SNMP read-write community). Using the switch's embedded Linux shell as a jump host, the same password yielded valid authenticated administrator sessions on four adjacent Ruijie devices on the internal management network: 10.10.15.8, 10.10.15.9, 192.168.7.3, and 10.10.11.3. The latter two had previously been assessed as patched against RCE but remain fully susceptible to takeover through credential reuse. Ruijie eweb login encrypts passwords using a per-device Gibberish-AES key scraped from each device's own login page, so reuse is not prevented by any per-device secret. Every successful login returned a live session (sid + token) and device serial number, demonstrating administrative control over the management plane.

PoC:
Show Content


9. HIGH — Adminer 4.8.1 exposed to the internet on shared SID origin (pre-auth PostgreSQL + SSRF)
Origin: 103.245.225.58 — /admin/ (all Host headers)
Impact: Pre-auth access to local PostgreSQL, SSRF to unprivileged ports

The shared SID origin 103.245.225.58 serves an Adminer 4.8.1 database management interface at /admin/ for EVERY Host header (all ~150 <kabupaten>.sipd.kemendagri.go.id names and even random ones), without IP restrictions. Although PHP lacks MySQL extensions, Adminer's PostgreSQL driver works and reaches the LOCAL PostgreSQL server (Unix-socket peer authentication, with the PHP process running as OS user "apache"), which is otherwise not exposed, and its Elasticsearch driver provides a pre-auth SSRF primitive to unprivileged ports. This turns an unauthenticated public web path into an entry point to the application database tier.

PoC:
Show Content


10. MEDIUM — Nextcloud username enumeration via public profile endpoint /u/<userId>
Host: cloud-adwil.kemendagri.go.id
Impact: Disclosure of valid account lists, department/organizational structure

The Nextcloud 25.0.2 EOL instance at cloud-adwil.kemendagri.go.id exposes an unauthenticated username-enumeration oracle: GET /u/<userId> returns a public profile page (HTTP 200, embedding the base64-encoded core-profileParameters initial state with userId/displayname) for VALID accounts, but falls back to the login page for nonexistent accounts. Without any credentials, the valid accounts 'admin', 'backup', and 'keuangan' were confirmed (with display names 'admin', 'Data Bagian Perencanaan', and 'Bagian Keuangan'), revealing department/organizational structure and providing an accurate unauthenticated list of valid accounts for targeted password guessing (non-email usernames ignored by this host's CVE-2023-32319 throttling path). This is a real, verified information-disclosure weakness; it does not independently grant access.

PoC:
Show Content


11. MEDIUM — SID origin 103.245.225.58 accepts arbitrary Host headers (Cloudflare bypass)
Origin: 103.245.225.58
Impact: CDN/WAF bypass, direct access to the entire ~150-host cluster

The shared SID Laravel application is served directly from origin 103.245.225.58 and derives the tenant/region from the FIRST LABEL of the HTTP Host header, ignoring the rest of the hostname: any hostname whose first label is a recognized region ('sipd', or a regency such as 'bandung') receives HTTP 200 even when the remainder is attacker-controlled (e.g. Host: sipd.kemendagri.go.id.evil.com -> 200/20836B; Host: bandung.sipd.kemendagri.go.id.attacker.net -> 200/21160B). The public FQDN sipd.kemendagri.go.id returns 403 through Cloudflare, so the origin provides a direct CDN/WAF bypass to the entire ~150-host cluster. The homepage also leaks an internal IP through console.log("172.24.4.36"). Separately, note that the login boundary itself could not be exploited: the JS-built login route POST /pusat/main/<apel>/login returns 404 on this origin, and the only actual action route /{seg}/main returns a constant 500, so no SQLi/auth-bypass evidence was obtained there.

PoC:
Show Content


12. LOW — Repository/deployment files exposed under /home/ (CodeIgniter stack + default template credentials disclosure)
Host: assessment.kemendagri.go.id
Impact: Stack disclosure, application provenance, default template credentials

The web root of assessment.kemendagri.go.id serves CodeIgniter application source-repository metadata files at /home/README.md (200), /home/composer.json (200), /home/CONTRIBUTING.md (200), and /home/.editorconfig (200). README.md contains the original template installation guide and discloses the framework (CodeIgniter 3 + SB Admin 2), the application's origin (the "Aplikasi Penjualan" POS template), and the template's DEFAULT LOGIN CREDENTIALS (admin: nugrohoff / pwd_nugroho, kasir: KSR58 / pwd_fakhrul). These defaults were tested against /home/login/proses_login and did NOT authenticate (both returned 303 -> /home/ with "Salah!"), but the disclosure still exposes the stack, application provenance, and credential material that could be reused in password-reuse attacks.

PoC:
Show Content


13. LOW — MariaDB 10.11.18 pre-auth username enumeration (103.27.206.204:3306)
Host: 103.27.206.204:3306
Version: MariaDB 10.11.18
Impact: Pre-authentication enumeration of valid database users

The internet-exposed MariaDB 10.11.18 service at 103.27.206.204:3306 discloses valid account names before authentication: failed logins for users that EXIST return error 1698 ("Access denied for user 'x'@Host"), while nonexistent users return error 1045 ("... (using password: YES)"). This provides an unauthenticated remote oracle for enumerating valid database users, narrowing subsequent credential brute-force attempts. No valid password was found (1,152 common username/password pairs were rejected), but the account list was exposed.

PoC:
Show Content


If you get profit don't forget me. 4 CRITICAL, 5 HIGH, 2 MEDIUM, 2 LOW.
If this is useful, please just comment.
If this is useful please just comment
Please take advantage and exploit it, because I am very happy today to meet many buyers.
Reply
DarkForums Members
Members
Posts: 38
Threads: 0
Joined: Jan 2026
Reputation: 0

#3
16-10-26, 11:54 AM
Wonderful thank you. Stay healthy always for you
Reply
DarkForums Members
Members
Posts: 5
Threads: 0
Joined: Oct 2026
Reputation: 0

#4
16-10-26, 01:16 PM
amazing dude
Reply
DarkForums Members
Members
Posts: 313
Threads: 0
Joined: Jun 2026
Reputation: 2

#5
16-10-26, 06:43 PM
thanks!
Reply


Forum Jump:


 Users browsing this thread: 1 Guest(s)