CVE-2024-56145: Craft CMS Remote Code Execution Vulnerability Due to PHP Configuration
Summary
CVE-2024-56145: Craft CMS has potential RCE when PHP register_argc_argv config setting is enabled. Affects craftcms/cms across 3 version ranges.
>= 3.0.0, < 3.9.14
>= 4.0.0-RC1, < 4.13.2
>= 5.0.0-RC1, < 5.5.2
Fixed in 3.9.14, 4.13.2 or 5.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Craft CMS is a flexible content management system designed for building websites and applications. It offers a user-friendly interface, robust templating capabilities, and extensive plugin support. However, it is vulnerable to a remote code execution (RCE) issue when the PHP configuration setting 'register_argc_argv' is enabled, potentially allowing attackers to execute arbitrary code.
Vulnerability Detail
The vulnerability arises from the PHP 'register_argc_argv' configuration setting being enabled in the php.ini file. This setting allows PHP scripts to access the command-line arguments passed to the script, which can be exploited by an attacker to execute arbitrary code. If an attacker can manipulate these arguments, they may gain unauthorized access to the system, leading to severe consequences such as data breaches or complete system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 3.9.143.9.14composer require craftcms/cms:3.9.14 -
>= 4.0.0-RC1, < 4.13.24.13.2composer require craftcms/cms:4.13.2 -
>= 5.0.0-RC1, < 5.5.25.5.2composer require craftcms/cms:5.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading is not immediately possible, you can mitigate the issue by disabling the 'register_argc_argv' setting in your php.ini configuration file. This can be done by setting 'register_argc_argv = Off'. After making this change, restart your web server to apply the new configuration.
Conclusion
The Craft CMS vulnerability identified as CVE-2024-56145 poses a significant risk due to the potential for remote code execution when the 'register_argc_argv' setting is enabled. It is crucial to update to the latest patched versions or disable the setting in the PHP configuration to mitigate this risk. Regular monitoring and vulnerability assessments are recommended to maintain the security of your applications.
See every vulnerability recorded for craftcms/cms →
FAQ
The vulnerability can lead to remote code execution, allowing attackers to execute arbitrary code on the server, which may result in data breaches or system compromise.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file without needing to sign up.
Craft CMS versions prior to 3.9.14, 4.13.2, and 5.5.2 are affected by this vulnerability.
Yes, you can disable the 'register_argc_argv' setting in your php.ini file as a temporary workaround until you can upgrade.
If you cannot upgrade immediately, ensure that 'register_argc_argv' is disabled in your PHP configuration to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
