Authenticated RCE Vulnerability in Craft CMS: Bypass of JSON Cleanse in Condition Handling
Summary
GHSA-265m-7826-wjqm: Craft CMS: Authenticated RCE via condition.config JSON cleanse bypass. Affects craftcms/cms across 2 version ranges.
>= 4.0.0-RC1, < 4.18.2
>= 5.0.0-RC1, < 5.10.6
Fixed in 4.18.2 or 5.10.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system designed for developers and content creators. It allows users to build custom websites and applications with ease, offering features such as a user-friendly control panel, powerful templating, and a robust plugin architecture. However, a significant vulnerability has been identified in its control panel element-search condition handling, which could allow authenticated users to execute arbitrary code.
Vulnerability Detail
Craft CMS has an authenticated remote code execution (RCE) vulnerability due to improper handling of the condition.config JSON string. The vulnerability arises because the system cleanses the outer request-controlled condition array but fails to reapply the cleanse on the decoded JSON string. This oversight allows attackers to inject Yii behavior/event configuration, leading to potential command execution as the PHP/web user. The attack is semi-blind, meaning the attacker does not receive direct feedback but can infer success through side effects, such as file writes.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.0.0-RC1, < 4.18.24.18.2composer require craftcms/cms:4.18.2 -
>= 5.0.0-RC1, < 5.10.65.10.6composer require craftcms/cms:5.10.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, ensure that only trusted users have access to the Craft control panel, and monitor for any unusual activity. Additionally, consider implementing strict input validation and sanitization for any user-controlled inputs.
Conclusion
The authenticated RCE vulnerability in Craft CMS poses a significant risk to users with control panel access. Immediate action is required to update to the latest patched versions to safeguard against potential exploitation. Regular monitoring and strict access controls are also recommended to mitigate risks.
See every vulnerability recorded for craftcms/cms →
FAQ
An authenticated user can execute arbitrary commands on the server, potentially leading to data breaches, unauthorized access to sensitive information, and denial of service.
Any user with authenticated access to the Craft CMS control panel is at risk, particularly those with permissions to modify conditions.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any installation.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
In addition to updating to the patched versions, ensure that only trusted users have access to the control panel and implement strict input validation.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
