Sonny Macdonald
Source-scoped identity with 2 associated PoCs and 5 linked vulnerabilities.
Exploit catalog results
Showing 2 PoCs on this page
MetasploitCommvault Command-Line Argument Injection to Traversal Remote Code Execution
Metasploit exploitby Piotr Bazydlo, plus 1 additional contributorAdded to Metasploit 2025-09-06ExploitCVE-2025-4428CVE-2025-57788CVE-2025-57790CVE-2025-577911 file
Analysis
Technical assessment
A Metasploit module that exploits an unauthenticated remote code execution chain in Commvault (CVE-2025-57790, CVE-2025-57791, CVE-2025-57788) to achieve command execution as NETWORK SERVICE on Windows.
Backdoor review
No backdoor observed in reviewed code
The reviewed Metasploit module source code implements a documented exploit chain (CVE-2025-57788, CVE-2025-57790, CVE-2025-57791) against Commvault. All actions—credential leakage, authentication bypass, path traversal, and expression language injection—serve the stated purpose of achieving remote code execution. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential exfiltration to a third party, persistence mechanisms, or unrelated payload delivery) was observed.
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit exploit module that implements a multi-step attack chain to achieve remote code execution. It includes code to leak credentials, bypass authentication, inject commands, and execute arbitrary payloads on the target.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:6modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:422-491Requirements
- Target must be a vulnerable Commvault instance (versions <= 11.32.101 or <= 11.36.59).
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:1 - The target must be running on Windows.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:437-439
Observed behavior
- Leaks the PublicSharingUser GUID password via an unauthenticated endpoint.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:84-100 - Authenticates as PublicSharingUser and leaks the target hostname and OS.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:137-181 - Bypasses authentication to obtain a localadmin token via command-line argument injection.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:237-254 - Leaks the full installation path using an authenticated API.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:256-268 - Uploads an XML file, injects an expression language payload into the localadmin user description, moves the XML file to a JSP web shell, and triggers remote code execution.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:307-394 - Cleans up the injected user description and registers the web shell for cleanup.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-393
Behaviors behind the backdoor verdict
Observables
- Credential Leakage
- Payload withheldPart of the documented exploit chain (CVE-2025-57788) to gain initial low-privilege access.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:94-95 - Authentication Bypass
- Payload withheldImplements CVE-2025-57791 to escalate privileges to localadmin.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:247-252 - Remote Code Execution
- Payload withheldImplements CVE-2025-57790 to achieve RCE; payload is the user-supplied Metasploit payload.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:310modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:490 - Cleanup Mechanism
- Payload withheldModule attempts to restore the modified user description and registers the web shell for deletion, consistent with normal Metasploit post-exploitation cleanup.
modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:375modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-392
What the analysis did not establish
- Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
- The module's actual behavior and reliability on live targets have not been verified through execution.
- Analysis is limited to the module source code and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded or reviewed.
- Binary files are not present in the evidence; no binary analysis was performed.
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.