Enterprise Tech In, Shell Out Progress Kemp LoadMaster Unini...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037
• Blog Title: Enterprise Tech In, Shell Out: Progress Kemp LoadMaster Uninitialized Heap to Pre-Auth RCE (CVE-2026-8037)
• Suggested Section: Network Services Pentesting -> 80,443 - Pentesting Web, as a new Kemp LoadMaster/management API page, with cross-references to Pentesting Web -> Command Injection and Binary Exploitation -> Libc Heap

🎯 Content Summary

Overview and affected scope

Progress Kemp LoadMaster is a load balancer and application delivery controller that provides Layer 4 and Layer 7 traffic management, SSL/TLS offloading, content switching, health checks, and WAF functionality. CVE-2026-8037 is a critical unauthenticated command-injection and remote-code-execution vulnerability reachable through the /accessv2 API when the API is enabled. Progress published its advisory on June 4, 2026. The affected versions are...

🔧 Technical Details

Unterminated heap string to command injection: A routine that allocates a heap buffer, copies attacker-controlled data, and fails to append a NUL terminator becomes dangerous when the result is later consumed as a C string by %s, sprintf, or similar APIs. If the overread reaches attacker-controlled bytes in a neighboring allocation and the resulting string is passed to system() or a shell, the adjacent bytes can become command-injection syntax.

Neutralizing tcache metadata with expansion: Reused tcache chunks can contain next and key metadata in the first 0x10 bytes of the user area. Those values may contain NUL bytes that stop a string overread. If an input transformation expands characters, select an input whose encoded representation is at least 0x10 bytes long; in this case, four single quotes expand to sixteen bytes and overwrite the stale metadata ...

🤖 Agent Actions

Plan:

1. Inspect the repository structure and at least five relevant pages.
2. Check for overlap in web command injection, heap exploitation, and appliance/API coverage.
3. Verify primary-source details and choose one best destination file.
4. Implement a concise, cited update, then validate formatting, links, and the diff.
   Repository review is complete: the generic primitive is not documented, while product pages and command-injection coverage would duplicate the appliance-specific chain. I’m placing the technique once in Binary Exploitation → Libc Heap, with only navigation links added elsewhere if needed. Next I’m verifying the primary advisory and vendor fix details before editing.
   The edit is implemented in one existing heap page, with primary-research, analysis, and vendor references in the repository’s numbered citation format. I’ve also verified the internal command-injection link, reference numbering, forbidden-source exclusion, and clean Markdown diff; I’m running the book build as the final check.
   Updated src/binary-exploitation/libc-heap/README.md with:

• Unterminated heap-string exploitation and stale-data injection.
• Tcache metadata neutralization using expanding transformations.
• JSON heap spraying and command-injection chaining.
• Debugging and remediation guidance.
• Numbered references to ZDI, watchTowr, and Progress.

Validation passed: clean diff, citations and internal link verified, forbidden sources absent. mdbook was unavailable, so a full book build could not be run.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://labs.watchtowr.com/enterprise-tech-in-shell-out-progress-kemp-loadmaster-uninitialized-heap-to-pre-auth-rce-cve-2026-8037

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting -> 80,443 - Pentesting Web, as a new Kemp LoadMaster/management API page, with cross-references to Pentesting Web -> Command Injection and Binary Exploitation -> Libc Heap".

Repository Maintenance:

• MD Files Formatting: 1031 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0