CVE-2024-52291: CraftCMS Local File System Validation Bypass Leading to File Overwrite and Potential Code Execution
Summary
CVE-2024-52291: A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). Affects craftcms/cms across 2 version ranges.
>= 4.0.0-RC1, < 4.12.5
>= 5.0.0-RC1, < 5.4.6
Fixed in 4.12.5 or 5.4.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CraftCMS is a popular content management system (CMS) that enables developers to build and manage websites with ease. It offers a flexible architecture, allowing for custom content types, user management, and asset handling. However, CraftCMS has a vulnerability that can be exploited by authenticated users with administrative privileges, particularly when the 'allowAdminChanges' setting is enabled. This vulnerability can lead to unauthorized access to sensitive files and potential remote code execution.
Vulnerability Detail
A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double 'file://' scheme (e.g., 'file://file:////'). This flaw is rooted in the improper sanitization of file paths in the FileHelper.php file, specifically in the normalizePath function. By exploiting this issue, an attacker with an authenticated admin account can specify sensitive folders as the base path for file uploads, leading to file overwriting, unauthorized access to sensitive files, and potential remote code execution through crafted Server-Side Template Injection (SSTI) payloads.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0-RC1, < 4.12.54.12.5composer require craftcms/cms:4.12.5 -
>= 5.0.0-RC1, < 5.4.65.4.6composer require craftcms/cms:5.4.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, disable the 'allowAdminChanges' setting in your CraftCMS configuration. This can be done by setting 'allowAdminChanges' to false in your config file, which will prevent unauthorized changes by admin users. Additionally, avoid using the 'file://' scheme for file paths until the vulnerability is patched.
Conclusion
CVE-2024-52291 is a critical vulnerability in CraftCMS that allows authenticated users to bypass local file system validation, leading to potential file overwriting and remote code execution. It is essential for users to update to the latest patched versions and implement recommended security practices to mitigate risks.
See every vulnerability recorded for craftcms/cms →
FAQ
The impact includes potential unauthorized access to sensitive files, file overwriting, and the risk of remote code execution if exploited by an authenticated admin user.
Any CraftCMS installation with an authenticated admin account and the 'allowAdminChanges' setting enabled is at risk.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2024-52291 is 8.4, indicating a high severity level.
If an immediate update is not possible, consider disabling the 'allowAdminChanges' setting and monitor your application closely for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
