bolt-cms-pentesting

name	bolt-cms-pentesting
description	How to exploit Bolt CMS for Remote Code Execution (RCE) via Twig template injection. Use this skill when pentesting Bolt CMS installations, when you need to check for SSTI vulnerabilities in Bolt CMS, or when you have admin access to a Bolt CMS instance and want to escalate to RCE. This skill covers the complete exploitation chain from admin login to code execution.

Bolt CMS Pentesting

A skill for exploiting Bolt CMS vulnerabilities to achieve Remote Code Execution (RCE) through Twig Server-Side Template Injection (SSTI).

Prerequisites

• Admin access to the Bolt CMS instance
• Network access to receive reverse shells (if using shell payloads)
• Authorization to perform security testing on the target

Exploitation Workflow

Step 1: Access Admin Configuration

1. Navigate to the admin panel at /bolt and log in with admin credentials
2. Go to Configuration -> View Configuration -> Main Configuration
   • Direct URL: /bolt/file-edit/config?file=/bolt/config.yaml
3. Identify the active theme - Note the theme name (e.g., base-2021)

Step 2: Locate Template File

1. Navigate to File management -> View & edit templates
2. Select the theme identified in Step 1
3. Open index.twig for editing
   • Direct URL pattern: /bolt/file-edit/themes?file=/THEME_NAME/index.twig

Step 3: Inject Twig Payload

Insert a Twig template injection payload into the template file. Common payloads:

Reverse Shell (Bash):