Command Injection in GroundWork Monitor Enterprise MONARCH Component

This repository contains a single Metasploit module (modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb) that exploits an OS command injection vulnerability (CVE-2013-3502) in GroundWork Monitor 6.7.0's monarch_scan.cgi script. The exploit targets authenticated users (any privilege level) and leverages improper input handling in a Perl qx function to execute arbitrary system commands on the server. The module first authenticates to the GroundWork web interface using provided credentials, retrieves a session token, and then sends a crafted request to the vulnerable CGI endpoint to trigger command execution. The exploit supports Metasploit's command payloads, allowing for flexible post-exploitation actions such as reverse shells. The code is written in Ruby and is fully integrated into the Metasploit framework, making it weaponized and easy to use for penetration testers. The main network endpoints involved are the authentication and vulnerable CGI paths under the GroundWork web application.