CVE-2024-54149: Winter CMS Modules Twig Sandbox Bypass Vulnerability
Summary
CVE-2024-54149: Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion. Affects winter/wn-cms-module across 3 version ranges.
< 1.0.476
>= 1.1.0, < 1.1.11
>= 1.2.0, < 1.2.7
Fixed in 1.0.476, 1.1.11 or 1.2.7, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Winter CMS is an open-source content management system built on the Laravel framework, designed for developers and users to create and manage websites easily. It offers a modular architecture, allowing for extensive customization through plugins and themes. However, certain versions of Winter CMS have a vulnerability that allows users with specific permissions to bypass the sandbox restrictions in Twig templates, potentially leading to unauthorized data modification and deletion.
Vulnerability Detail
The vulnerability arises from insufficient sandboxing in Twig templates used by Winter CMS. Users with access to modify Twig files can exploit this flaw to alter theme customization values or even delete templates without having direct permissions. Since objects passed to Twig are references to live data, attackers can manipulate model data directly, including changing attributes or removing records. This poses significant risks, as it allows unauthorized changes to the application's data integrity and security.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.0.4761.0.476composer require winter/wn-cms-module:1.0.476 -
>= 1.1.0, < 1.1.111.1.11composer require winter/wn-cms-module:1.1.11 -
>= 1.2.0, < 1.2.71.2.7composer require winter/wn-cms-module:1.2.7
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not feasible, you can manually apply the patch from the following commit to your Winter CMS installation: https://github.com/wintercms/winter/commit/fb88e6fabde3b3278ce1844e581c87dcf7daee22. This will increase the sandbox scope, making all models and datasources read-only in Twig templates.
Conclusion
CVE-2024-54149 is a significant vulnerability in Winter CMS that allows unauthorized modifications through Twig templates. It is crucial for users with relevant permissions to update their installations to the latest patched versions or apply the provided workaround to safeguard their applications from potential exploits.
See every vulnerability recorded for winter/wn-cms-module →
FAQ
The impact includes unauthorized data modification and deletion, which can compromise the integrity of the application.
Users with permissions to manage layouts, pages, or partials in Winter CMS are at risk if they can modify Twig templates.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate upgrading is not possible, apply the manual patch provided in the workaround section to mitigate the risk.
The CVSS score for CVE-2024-54149 is 8.4, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for winter/wn-cms-module.
