CVE-2024-52293: Craft CMS Remote Code Execution via Missing Path Normalization
Summary
CVE-2024-52293: Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI. Affects craftcms/cms across 2 version ranges.
>= 4.0.0-RC1, < 4.12.2
>= 5.0.0-RC1, < 5.4.3
Fixed in 4.12.2 or 5.4.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system designed for developers and designers to create and manage websites efficiently. It offers a user-friendly interface, powerful templating capabilities, and a robust plugin architecture. However, it is vulnerable to a critical issue that allows for potential remote code execution due to improper path normalization in its file handling functions.
Vulnerability Detail
The vulnerability arises from a missing normalization step in the FileHelper::absolutePath function, which can lead to remote code execution via Server-Side Template Injection (SSTI). Specifically, the function concatenates paths without ensuring they are properly normalized, allowing attackers to manipulate file paths and bypass security checks. This can result in unauthorized access to sensitive files or execution of arbitrary code on the server. The vulnerability is particularly dangerous when the configuration allows admin changes, as it can be exploited by authenticated users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0-RC1, < 4.12.24.12.2composer require craftcms/cms:4.12.2 -
>= 5.0.0-RC1, < 5.4.35.4.3composer require craftcms/cms:5.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the feature that allows admin changes by setting ALLOW_ADMIN_CHANGES to false in your configuration. However, this does not fully mitigate the risk and updating to the latest version is strongly recommended.
Conclusion
CVE-2024-52293 represents a significant security risk for Craft CMS installations due to its potential for remote code execution. Users are strongly advised to update to the latest patched versions to mitigate this vulnerability. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for craftcms/cms →
FAQ
CVE-2024-52293 is a vulnerability in Craft CMS that allows for potential remote code execution due to missing path normalization in file handling functions.
You can check if your installation is affected by using Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to analyze your composer.lock file without any signup.
Exploitation of this vulnerability can lead to remote code execution, allowing attackers to take control of the server, exfiltrate data, or deploy malware.
Yes, the vulnerability has been patched in Craft CMS versions 4.12.2 and 5.4.3. It is important to update to these versions to secure your installation.
If immediate updating is not possible, consider disabling admin changes by setting ALLOW_ADMIN_CHANGES to false as a temporary measure, but plan to update as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
