Rapid7 Vulnerability & Exploit Database

Bolt CMS 3.7.0 - Authenticated Remote Code Execution

Back to Search

Bolt CMS 3.7.0 - Authenticated Remote Code Execution

Disclosed
05/07/2020
Created
06/29/2020

Description

This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0 and 3.6.* in order to execute arbitrary commands as the user running Bolt. This module first takes advantage of a vulnerability that allows an authenticated user to change the username in /bolt/profile to a PHP `system($_GET[""])` variable. Next, the module obtains a list of tokens from `/async/browse/cache/.sessions` and uses these to create files with the blacklisted `.php` extention via HTTP POST requests to `/async/folder/rename`. For each created file, the module checks the HTTP response for evidence that the file can be used to execute arbitrary commands via the created PHP $_GET variable. If the response is negative, the file is deleted, otherwise the payload is executed via an HTTP get request in this format: `/files/?<$_GET_var>=` Valid credentials for a Bolt CMS user are required. This module has been successfully tested against Bolt CMS 3.7.0 running on CentOS 7.

Author(s)

  • Sivanesh Ashok
  • r3m0t3nu11
  • Erik Wynter

Platform

Linux,Unix

Architectures

x86, x64, cmd

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use exploit/unix/webapp/bolt_authenticated_rce
msf exploit(bolt_authenticated_rce) > show targets
    ...targets...
msf exploit(bolt_authenticated_rce) > set TARGET < target-id >
msf exploit(bolt_authenticated_rce) > show options
    ...show and set options...
msf exploit(bolt_authenticated_rce) > exploit

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;