CVE-2023-38646

[@Giperium]

Thank you friend, other ways didn't work for me, your method made my day brighter. Long life to you, my friend!!!

[@user-wl6qf1wy2t]

thanks bro

[@nodopamine6243]

Where did you get the payload?

[@user-vf9jr9jh7m]

hello, i just refer to this blog,it help a lot blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/

[@uchiha888]

When I send the payload, I get a response ""message":"Vector arg to map conj must be a pair"". Any ideas? Thank you

[@JGerard0]

the problem is the "=" at base64 encode, to fix it replace "=" with "%3d"

[@user-vf9jr9jh7m]

@@JGerard0 thx u sir, just a little busy in the job, forget to read the message . Thanks again

[@user-uo5rd4uf7l]

你好，我想一下，docker拉出来的容器，访问api/setup/validate ，提示"API endpoint does not exist."。对复现有影响吗

[@user-vf9jr9jh7m]

如果是因為直接訪問api/setup/validate ，metabase可能會因為沒有收到setup-token，導致你要傳的payload 他不接受，因而對你的復現會有引響。