Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 4.17.12, 5.9.18
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 6 proofs of concept on GitHub
- Exploitation: poc
- Automatable: no
- Technical impact: total
Summary
Craft CMS is a content management system (CMS). From 4.0.0 to before 4.17.12 and 5.9.18, Craft CMS which contains an input-handling flaw in a Yii object creation path that let any authenticated user inject malicious configuration and execute arbitrary commands on the server. The request-controlled condition field layouts data is converted into a live FieldLayout object without a Component::cleanseConfig() boundary. Because Craft configures models before parent::__construct(), attacker-controlled special config keys can take effect during object creation, and FieldLayout initialization then triggers a same-request event. This vulnerability is fixed in 4.17.12 and 5.9.18.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: poc · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- craftcms cms
From 4.0.0 · fixed in 4.17.12; From 5.0.0 · fixed in 5.9.18
- craftcms/cmsPackagist
From 4.0.0 · fixed in 4.17.12
- craftcms/cmsPackagist
From 5.0.0 · fixed in 5.9.18