CVE-2024-52292: Craft CMS Arbitrary System File Read Vulnerability
Summary
CVE-2024-52292: Craft CMS Arbitrary System File Read. Affects craftcms/cms across 2 version ranges.
>= 3.5.13, < 4.12.8
>= 5.0.0-alpha.1, < 5.4.9
Fixed in 4.12.8 or 5.4.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system designed for building websites and applications. It offers a user-friendly interface, powerful templating capabilities, and a robust plugin architecture. However, it is susceptible to vulnerabilities that can lead to unauthorized access to sensitive files on the server, particularly when write permissions are misconfigured on system notification templates.
Vulnerability Detail
The vulnerability arises from the misuse of the dataUrl function within Craft CMS, which allows an attacker with write permissions on system notification templates to read arbitrary files from the server. By embedding the dataUrl function in a notification template, the attacker can trigger an email that contains Base64-encoded content of sensitive files. This can lead to exposure of critical information such as configuration files, credentials, and other sensitive data, potentially resulting in privilege escalation and server compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.5.13, < 4.12.84.12.8composer require craftcms/cms:4.12.8 -
>= 5.0.0-alpha.1, < 5.4.95.4.9composer require craftcms/cms:5.4.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that write permissions on system notification templates are restricted to trusted users only. Additionally, avoid using the dataUrl function in notification templates until the package is updated.
Conclusion
CVE-2024-52292 represents a significant security risk for Craft CMS users, allowing unauthorized access to sensitive files. It is crucial to update to the latest versions to mitigate this vulnerability and ensure the security of your application.
See every vulnerability recorded for craftcms/cms →
FAQ
CVE-2024-52292 is a vulnerability in Craft CMS that allows arbitrary file reading through misconfigured system notification templates.
You can check your installation against the affected versions listed in the vulnerability report. Additionally, you can use Vulert to monitor for vulnerabilities in your Composer dependencies.
The risks include exposure of sensitive information, privilege escalation, server compromise, and potential breaches of user data confidentiality.
Restrict write permissions on system notification templates and avoid using the dataUrl function in templates until the vulnerability is patched.
Vulert is a tool that monitors open-source vulnerabilities in your software using the composer.lock file. It provides real-time alerts and can help you determine if your application is affected by vulnerabilities like CVE-2024-52292.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
