# ConnectWise/R1Soft RCE & Supply Chain Risks

ZK framework auth bypass in ConnectWise R1Soft SBM let attackers upload a backdoored JDBC driver for root RCE and push ransomware to all managed agents.

- Payout: Real-world hack
- Severity: critical
- Program: ConnectWise R1Soft
- Credited: Huntress
- Disclosed: 2022-10-31
- CVE: CVE-2022-36537
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/critical-vulnerability-disclosure-connectwise-r1soft-server-backup-manager-remote-code-execution-supply-chain-risks
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-critical-vulnerability-disclosure-connectwise-r1soft-server-backup-manager-remote-code-execution-suppl
- Tags: domain:web impact:mass-exploit impact:rce kind:incident platform:threat-intel sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** Server Backup Manager SE web app (ZK framework /zkau/upload endpoint)
**Root cause:** ZK framework's /zkau/upload endpoint accepts a nextURI parameter that performs an internal forward, allowing unauthenticated POST requests to reach protected server-side resources (auth bypass). R1Soft then allows admin JDBC driver upload to a temp dir added to the classpath, yielding code execution as root.
**Steps:**
1. Send unauthenticated POST to `/zkau/upload` with a `nextURI` query parameter pointing at internal protected resources (e.g. `/WEB-INF/web.xml`, `zk.xml`) to leak files.
2. Use the internal-forward primitive to issue arbitrary POST requests as an authenticated admin, simulating ZK widget/event IDs sequentially.
3. Upload a malicious JDBC driver JAR via the admin 'add database driver' feature; it lands in the server temp directory and is added to the classpath.
4. Trigger the driver to execute arbitrary code; SBM service runs as root.
5. Use the REST API to send commands to registered agents, pushing payloads (e.g. Lockbit 3.0) to all downstream endpoints.
**How found:** Florian Hauser noticed the ZK library bundled in R1Soft and teased Burp screenshots of the auth bypass on Twitter; Huntress reproduced it via trial-and-error, then decompiled Java classes and explored app features, landing on the JDBC driver upload as the RCE path.
**Exploitation:** Unauthenticated attacker abuses ZK /zkau/upload nextURI internal forward to bypass auth, then as admin uploads a backdoored JDBC driver (Airman604 primitive) to gain root RCE on the backup server, then uses the REST API to command registered agents and push ransomware to all managed endpoints.
**Escalation:** Chained auth bypass -> file read (private keys, licenses, configs) -> JDBC driver upload RCE as root -> REST API pivot to all registered downstream agents, enabling mass ransomware deployment across MSP customers.
**Insight:** When a framework CVE gives you an internal-forward/auth-bypass primitive, enumerate the host app's admin-only features (custom driver/plugin uploads added to classpath) as the RCE path rather than stopping at file read.