A critical authentication bypass vulnerability in Xerte Online Toolkits enables unauthenticated remote code execution, posing an immediate risk to system integrity.

The application fails to properly terminate sessions for unauthenticated users accessing the /editor/elfinder/php/connector.php endpoint, allowing request processing to continue. This flaw permits unauthenticated attackers to manipulate file operations, which can be chained with other vulnerabilities to achieve remote code execution.

The exploitation of this vulnerability leads to full remote code execution, granting attackers the ability to compromise server-side data, modify application files, or gain persistent control over the host environment. With a CVSS score of 8.6, this flaw represents a high-severity risk that could lead to complete system compromise, data theft, and significant operational disruption.

Immediate Action: Upgrade to the latest version of Xerte Online Toolkits, as patches have been backported to versions 3.13, 3.14, and 3.15 to resolve this issue.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the /editor/elfinder/php/connector.php endpoint, particularly those involving file manipulation commands like mkdir, upload, or rename.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the /editor/elfinder/php/connector.php path until all instances are updated.

Public Exploit Available: Yes, a public proof-of-concept and a Metasploit module exist, as documented in the associated research write-up and the Metasploit framework.

Given the availability of functional exploit code and the critical nature of remote code execution, organizations must prioritize patching this vulnerability immediately. Ensure all instances of Xerte Online Toolkits are updated to the latest secure version to prevent potential unauthorized access and system compromise.