module

Bolt CMS 3.7.0 - Authenticated Remote Code Execution

Try Surface Command
Back to search
Disclosed
05/07/2020
Created
06/29/2020

Description

This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0
and 3.6.* in order to execute arbitrary commands as the user running Bolt.

This module first takes advantage of a vulnerability that allows an
authenticated user to change the username in /bolt/profile to a PHP
`system($_GET[""])` variable. Next, the module obtains a list of tokens
from `/async/browse/cache/.sessions` and uses these to create files with
the blacklisted `.php` extention via HTTP POST requests to
`/async/folder/rename`. For each created file, the module checks the HTTP
response for evidence that the file can be used to execute arbitrary
commands via the created PHP $_GET variable. If the response is negative,
the file is deleted, otherwise the payload is executed via an HTTP
get request in this format: `/files/?=`

Valid credentials for a Bolt CMS user are required. This module has been
successfully tested against Bolt CMS 3.7.0 running on CentOS 7.

Authors

Sivanesh Ashokr3m0t3nu11Erik Wynter

Platform

Linux,Unix

Architectures

x86, x64, cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands ‘show options’ or ‘show advanced’:

    msf > use exploit/unix/webapp/bolt_authenticated_rce
    msf /(e) > show actions
        ...actions...
    msf /(e) > set ACTION < action-name >
    msf /(e) > show options
        ...show and set options...
    msf /(e) > run
Title
NEW

Explore Exposure Command

Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.

Try it today