External risk intelligence

Bolt CMS Directory Traversal and Denial of Service Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2022-31321

Bolt is a content management system designed to be deployed as a web application. Web applications and CMS platforms are commonly exposed to the public internet to serve content, making the underlying input parameters frequently reachable by external users.

Denial of Service

Boltcms Bolt

5.7 and earlier

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in the Bolt content management system, identified by CVE-2022-31321. The vulnerability arises from insufficient validation of the 'foldername' parameter, which could enable unauthorized users to discover directory structures or disrupt service availability. While the specific impact depends on your organization's use of Bolt, this type of flaw generally warrants a review of affected systems.

A flaw allows directory listing or service disruption.
This vulnerability affects web applications and content management.
Confirm if Bolt is used to understand potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can leverage this vulnerability by sending specially crafted input to the foldername parameter of an exposed Bolt CMS application. This lack of proper input validation could allow an attacker to uncover directory structures or disrupt the service by causing a denial of service.

Requires no prior access.
Triggers via foldername parameter.
Can reveal directories or crash the service.

Live Threat

Current exploitation, exposure, and threat context

The `foldername` parameter in Bolt CMS, when exposed to the internet, could allow unauthorized access to sensitive information through directory enumeration, or disrupt service availability via a Denial of Service attack.

System data could be exposed.
Directory traversal may occur.
Service could become unavailable.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Bolt likely impacts application owners or platform teams responsible for the content management system. The initial step is to identify all instances of Bolt, determine their reachability and criticality, and then assign ownership for remediation planning.

Confirm application and platform ownership.
Verify external reachability and business criticality.
Plan remediation based on confirmed exposure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Bolt CMS?

Bolt is an open-source content management system built with PHP and Symfony. It is designed for developers and content editors to create and manage websites by providing a flexible framework for structuring content. Because it powers web-facing applications, it is typically deployed on servers accessible to internet traffic.

What is the nature of the flaw in CVE-2022-31321?

This vulnerability is classified as CWE-20, which stands for Improper Input Validation. In the context of this CVE, it means the software fails to properly sanitize data sent to the 'foldername' parameter. This oversight allows an attacker to send unexpected input that the application processes incorrectly, potentially leading to directory enumeration or a denial of service.

How can an attacker trigger this vulnerability?

An attacker triggers the bug by sending a specially crafted request to the 'foldername' parameter within the application. It is important to note that this flaw does not require the attacker to have prior authentication or special user privileges. Legitimate, non-malicious interactions with standard CMS features that do not involve manipulating the 'foldername' parameter do not trigger this specific issue.

Is my Bolt instance at risk?

Halo Surface Signal indicates that Bolt instances are likely exposed because CMS platforms are typically deployed as public-facing web applications to serve content. If your instance is accessible from the internet, it is reachable by external users who could attempt to leverage this parameter. Instances restricted to internal networks have a smaller attack surface, though they remain vulnerable if reachable by unauthorized internal actors.

What should I do if I run Bolt CMS?

Your first step is to locate all deployments of Bolt within your infrastructure to assess their criticality. Once identified, confirm whether these instances are exposed to the public internet or contained within your internal network. Prioritize these systems for review and coordinate with your technical teams to plan for necessary software updates or configuration changes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.