Exploit for Unrestricted Upload of File with Dangerous Type in Rsjoomla Rsfiles\! CVE-2026-57827

## https://sploitus.com/exploit?id=5EF7DE3B-0FFD-5474-8BD5-9CC13B531FFE
# CVE-2026-57827 — RSFiles! Unauthenticated File Upload → RCE

> **Disclaimer — authorized use only.**
> This is a **proof-of-concept** for **security research and defensive testing**.
> You are responsible for using it **only on systems you own or have explicit
> written permission to test**. Misuse against third parties without consent is
> illegal. See [SECURITY.md](SECURITY.md) for the responsible-disclosure stance.

Exploit + standalone detector for **CVE-2026-57827** in the **RSFiles!**
(`com_rsfiles`) component for Joomla, versions **< 1.17.12** (fixed in
`1.17.12`, CVSS 9.8 / 10.0).

The frontend upload is split across two tasks:
1. `rsfiles.checkupload` — pre-flight gate (permission + extension allow-list)
2. `rsfiles.upload` — write method (no permission check, no file-type check, no CSRF)

The write task can be called **directly**, skipping the pre-flight gate, which
lets an unauthenticated attacker upload an executable `.php` file into a public
folder and run it → **unauthenticated RCE**.

---

## ⚠️ What this project is / isn't

- ✅ A clean, readable re-implementation of the *described* attack chain for
  researchers and defenders.
- ✅ Includes a **local mock server** so you can validate the whole flow with
  **zero risk** to anything real.
- ✅ Includes a **detection-only** mode that makes **no upload at all**.
- ❌ Not an authorized PoC from the vendor — no public PoC exists, so this is an
  independent implementation based on the public advisory.

---

## Files

| File | Purpose |
|---|---|
| `cve_2026_57827.py` | Exploit + scanner + CLI (entry point) |
| `rsfiles_detect.py` | Standalone detection module (no exploit) — also has its own CLI |
| `payload.py` | Modular, compact PHP payload builder |
| `common.py` | Shared HTTP client, config, and helpers |
| `mock_server.py` | Safe local simulation for testing |

All modules must live in the **same directory** (they import each other).

## Install

```bash
python3 -m pip install -r requirements.txt   # or just: pip install requests
```

## Usage

### 1 · Detection only (no upload, safe for reconnaissance)

```bash
python rsfiles_detect.py -t example.com
```

```
Host     : example.com
RSFiles! : YES v1.17.11
Protocol : https
Status   : VULNERABLE  (below 1.17.12)
```

Multi-host:
```bash
python rsfiles_detect.py -f hosts.txt
```

### 2 · Full exploit (single target)

```bash
python cve_2026_57827.py -t example.com
```

On success the tool prints the shell URL **with its random token** and the
command output — that output is the proof of RCE.

### 3 · Mass scan + reports

```bash
python cve_2026_57827.py -f targets.txt --threads 30 -o shells.txt --csv report.csv
```

| Flag | Description |
|---|---|
| `--threads N` | Concurrency (default 30) |
| `--proxy URL` | Route through a proxy (Burp/ZAP) |
| `--timeout N` | Per-request timeout (seconds) |
| `--no-cleanup` | Keep the uploaded shell (default: auto-delete after RCE) |
| `-o FILE` | Save RCE URLs |
| `--csv FILE` | Full structured report |
| `--debug` / `-v` | Verbose request-level logging |

## Local testing (zero risk)

```bash
# Terminal 1 — start the mock (vulnerable)
python mock_server.py 8000 1.17.11

# Terminal 2 — scan it
python rsfiles_detect.py -t 127.0.0.1:8000
python cve_2026_57827.py -t 127.0.0.1:8000
```

`1.17.11` / `1.17.10` = vulnerable · `1.17.12` = patched.

## Design notes

- **Modular payload** (`payload.py`): each behaviour (gate, upload, exec,
  delete, list) is one small function; exec-function names are base64-encoded
  so raw names like `system` don't appear in the file bytes.
- **Randomized benign filenames** (e.g. `cache7f31.php`) instead of classic
  hidden dotfile shell names.
- **Incremental counters** (O(1)) instead of re-scanning results.
- **Single-source URL parsing** via `common.base_of()`.

## Credits / inspiration

Style modelled on public Joomla component-exploit collections (e.g.
`incredibleindishell/joomla-vulnerabilities`) and the RSJoomla/mysites.guru
advisory write-ups for this CVE. This is an independent implementation; no
public PoC was used.

## License

MIT — see [LICENSE](LICENSE). Research/defense use only.