Rapid7 Details Unauthenticated File-Upload-to-RCE Flaw in BeyondTrust Remote Support (CVE-2026-102764)
Summary
Rapid7 demonstrated CVE-2026-102764 in Remote Support 24.1.2: an anonymous customer session could forge a local MRS router ID, upload a PHP file, and execute code as msfuser. Other affected releases and fixed builds remain undetermined.
Key points
- The flaw lets a network client use reserved router ID 1 to bypass the worker's local-origin check.
- An attacker can start a public anonymous customer session; credentials and user interaction are not required.
- Forged messages reach the native file-transfer service, allowing control of uploaded file contents and destination paths within the worker's filesystem permissions.
- In Rapid7's test of Remote Support 24.1.2, build 1524046, an uploaded PHP file in the public directory executed code as msfuser, UID 1000.
- The Metasploit module implements the chain with PHP and Unix command targets.
- Rapid7 recommends correlating public session creation with unfamiliar endpoint requests, file changes, transfer logs, and unusual outbound connections; session creation or a 200/404 sequence alone is not sufficient evidence.
- The article does not establish which other releases are affected or identify fixed builds.
Article Details
- Attack Vectors
- An unauthenticated attacker can start a public Remote Support customer session without credentials or representative interaction.
- The attacker forges the message's MRS source router ID as reserved value 1, causing thin-scc to treat the network message as locally originated.
- The forged message reaches the native `local` file-transfer provider, allowing attacker-selected file contents and destination paths through `DownloadAnonymousFiles`; `UploadFiles` can retrieve appliance files.
- On the tested appliance, the attacker uploaded PHP into the public document root and executed it through an extensionless URL, obtaining code execution as `msfuser` (UID 1000).
- Rapid7 demonstrated the chain on Remote Support 24.1.2, build 1524046. Other affected releases and fixed builds were not established.
- Defensive Notes
- Correlate public session creation with requests to new or unfamiliar endpoints, file changes in the public directory, and unusual outbound connections; session creation alone is normal activity.
- Inspect the public directory for unexpected PHP files and investigate `.php.n$t` temporary files in context. The demonstrated payload executed through an extensionless URL, so detections limited to requests ending in `.php` may miss it.
- Review `httpd_access.log`, `thin-scc.log`, `thin-scc-errors.log`, and `brain.log` under `$BG_app_root/log/`; for live sessions, also collect worker logs under `$BG_app_root/data/tmp/sdcust_thin_client/<thinMint>/`.
- A `DISCARDING NONLOCAL MESSAGE` entry can indicate a rejected file-transfer attempt, but a successful forged-origin exploit may not produce that warning. Customer connection records and generic connection errors are not sufficient by themselves to establish exploitation.
- The article did not establish affected releases beyond the tested version or identify fixed builds.
MITRE ATT&CK
T1005 · Data from Local SystemThe native `UploadFiles` operation retrieves `/proc/self/environ` from the appliance to identify the Remote Support installation path.T1041 · Exfiltration Over C2 ChannelThe worker sends the contents of `/proc/self/environ` to the tester's MRS listener through the native file-transfer operation.T1059.004 · Unix ShellThe Metasploit module's Unix Command target wraps a Unix command in PHP, and testing produced a Bash shell as `msfuser`.T1070.004 · File DeletionThe demonstrated PHP payload unlinks its uploaded file after checking the execution token.T1105 · Ingress Tool TransferThe exploit serves PHP bytes through an MRS listener controlled by the tester and writes them to the appliance's public web directory using `DownloadAnonymousFiles`.T1190 · Exploit Public-Facing ApplicationThe exploit targets the public Remote Support customer-session interface without authentication, forging an MRS source router ID to reach the worker's native file-transfer service and achieve code execution.T1505.003 · Web ShellThe exploit places a PHP payload in the public web directory and executes it through an extensionless URL; the demonstrated payload checks a token and deletes itself.
Vendors
Products
Tools
GhidraAddresses use Ghidra image base 0x100000. Subtract that value for the raw ELF virtual address. Function names beginning with FUN_ are Ghidra labels; descriptive names are taken from diagnostic strings where available.Metasploit Frameworkfile to the site's public directory. Requesting that file gave us code execution as the site user. A Metasploit module now implements the chain with PHP and Unix Command targets.