# CVE-2022-46604: FileManager - RCE

> Live exploitation tracking for CVE-2022-46604 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2022-46604

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.8
- **Public exploit available:** Yes
- **Affected products:** Tecrail Responsive FileManager
- **Weaknesses:** CWE-434 (Unrestricted Upload of File with Dangerous Type)
- **Tags:** file_sharing

## Description

An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.

## CrowdSec analysis

[CVE-2022-46604](https://euvd.enisa.europa.eu/vulnerability/CVE-2022-46604) is a vulnerability in Tecrail Responsive FileManager that allows attackers to bypass file extension checks and upload crafted PHP files, leading to arbitrary code execution on the target server.  

CrowdSec has been tracking this vulnerability and its exploits since 12th of June 2024.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2022-46604 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2022-46604 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2022-46604 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts are often detected by requests to URLs that include either `/filemanager/dialog.php` or `/filemanager/execute.php`.

## Timeline

- 2023-02-02: CVE Published. CVE-2022-46604 is published to NVD.
- 2024-06-12: Rule Released. CrowdSec releases a rule to detect CVE-2022-46604 exploitation attempts against the CrowdSec Network.
- 2024-06-12: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2022-46604 for the first time.

## References

- https://medium.com/%40_sadshade/file-extention-bypass-in-responsive-filemanager-9-5-5-leading-to-rce-authenticated-3290eddc54e7
- https://github.com/trippo/ResponsiveFilemanager/blob/v9.9.5/filemanager/execute.php
- https://github.com/trippo/ResponsiveFilemanager/blob/v9.9.6/changelog.txt

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2022-46604) follows observed exploitation activity for CVE-2022-46604. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.