Craft CMS Vulnerable to Server-Side Template Injection
Summary
CVE-2018-20465: Craft CMS Vulnerable to Server-Side Template Injection. Affects craftcms/cms versions < 3.0.34. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is an open-source content management system that allows users to create and manage websites. It provides a flexible and customizable platform for developers and content creators. Craft CMS versions up to 3.0.34 are affected by a server-side template injection vulnerability. This vulnerability allows remote authenticated administrators to read sensitive information by injecting malicious code into the URI Format of the Site Settings.
Vulnerability Detail
The server-side template injection vulnerability in Craft CMS allows an attacker to execute arbitrary code on the server. By injecting a specific string into the URI Format of the Site Settings, an attacker can retrieve sensitive information such as the cleartext username and password for the database. This can lead to unauthorized access to the database and potential exposure of sensitive data. The vulnerability has a CVSS score of 7.2, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a temporary workaround is to sanitize user input and validate the URI Format field in the Site Settings. This can be done by implementing input validation and filtering techniques to prevent the execution of malicious code. Here is an example of how to sanitize the input in PHP:
$uriFormat = filter_input(INPUT_POST, 'uriFormat', FILTER_SANITIZE_STRING);
Conclusion
Craft CMS versions up to 3.0.34 are vulnerable to a server-side template injection vulnerability. This vulnerability allows remote authenticated administrators to read sensitive information by injecting malicious code into the URI Format of the Site Settings. To mitigate the vulnerability, it is advised to upgrade Craft CMS to version 3.0.35 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for craftcms/cms →
FAQ
Craft CMS is an open-source content management system that provides a flexible and customizable platform for creating and managing websites.
Server-side template injection is a vulnerability that allows an attacker to inject malicious code into a server-side template, which is then executed on the server. This can lead to arbitrary code execution and potential data exposure.
The Craft CMS vulnerability allows remote authenticated administrators to read sensitive information, such as database credentials, by injecting malicious code into the URI Format of the Site Settings. This can lead to unauthorized access to the database and potential exposure of sensitive data.
The vulnerability has a CVSS score of 7.2, indicating a high severity level.
To fix the vulnerability, it is recommended to upgrade Craft CMS to version 3.0.35 or later. The latest version includes a patch that addresses the server-side template injection issue.
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
