Commvault Command-Line Argument Injection to Traversal Remote Code Execution

MetasploitMetasploit exploitExploitRubyexploit_windows/http/commvault_rce_cve_2025_57790_cve_2025_57791

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Metasploit module that exploits an unauthenticated remote code execution chain in Commvault (CVE-2025-57790, CVE-2025-57791, CVE-2025-57788) to achieve command execution as NETWORK SERVICE on Windows.

Backdoor review

No backdoor observed in reviewed code

The reviewed Metasploit module source code implements a documented exploit chain (CVE-2025-57788, CVE-2025-57790, CVE-2025-57791) against Commvault. All actions—credential leakage, authentication bypass, path traversal, and expression language injection—serve the stated purpose of achieving remote code execution. No concealed, unrelated, or operator-directed harmful behavior (e.g., credential exfiltration to a third party, persistence mechanisms, or unrelated payload delivery) was observed.

ClassificationExploit
Model confidence100%
AuthenticationNot required
Languagesruby
Target softwareCommvault CommCell
Attack typescommand_injectionpath_traversalauthentication_bypassexpression_language_injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a complete Metasploit exploit module that implements a multi-step attack chain to achieve remote code execution. It includes code to leak credentials, bypass authentication, inject commands, and execute arbitrary payloads on the target.

modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:6modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:422-491

Requirements

  • Target must be a vulnerable Commvault instance (versions <= 11.32.101 or <= 11.36.59).modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:1
  • The target must be running on Windows.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:437-439

Observed behavior

  • Leaks the PublicSharingUser GUID password via an unauthenticated endpoint.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:84-100
  • Authenticates as PublicSharingUser and leaks the target hostname and OS.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:137-181
  • Bypasses authentication to obtain a localadmin token via command-line argument injection.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:237-254
  • Leaks the full installation path using an authenticated API.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:256-268
  • Uploads an XML file, injects an expression language payload into the localadmin user description, moves the XML file to a JSP web shell, and triggers remote code execution.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:307-394
  • Cleans up the injected user description and registers the web shell for cleanup.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-393
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Leakage
PublicSharingUser GUID password extracted from unauthenticated endpointPart of the documented exploit chain (CVE-2025-57788) to gain initial low-privilege access.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:94-95
Authentication Bypass
Command-line argument injection in login request to obtain localadmin tokenImplements CVE-2025-57791 to escalate privileges to localadmin.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:247-252
Remote Code Execution
Expression language injection payload executed via user description update and web shellImplements CVE-2025-57790 to achieve RCE; payload is the user-supplied Metasploit payload.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:310modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:490
Cleanup Mechanism
User description reset and web shell file registration for cleanupModule attempts to restore the modified user description and registers the web shell for deletion, consistent with normal Metasploit post-exploitation cleanup.modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:375modules/exploits/windows/http/commvault_rce_cve_2025_57790_cve_2025_57791.rb:384-392
Review boundaries

What the analysis did not establish

  • Analysis is based solely on the provided Metasploit module source code and metadata; framework mixins, libraries, and external payloads are not expanded.
  • The module's actual behavior and reliability on live targets have not been verified through execution.
  • Analysis is limited to the module source code and metadata; Metasploit framework mixins, libraries, and external payloads are not expanded or reviewed.
  • Binary files are not present in the evidence; no binary analysis was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

4