Code Injection and Remote Execution in contao/core
Summary
GHSA-wxxw-5gq6-j2g5: contao/core Insufficient input validation allows for code injection and remote execution. Affects contao/core across 2 version ranges.
>= 2.0.0, < 2.11.17
>= 3.0.0, < 3.2.9
Fixed in 2.11.17 or 3.2.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
contao/core is an open-source package available on Packagist. It is a popular content management system (CMS) used for creating and managing websites. The package provides various functionalities for website development, including user management, page creation, and content organization. However, versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 of contao/core are vulnerable to a critical security issue that allows for code injection and remote execution.
Vulnerability Detail
The vulnerability in contao/core arises from insufficient input validation. Attackers can exploit this vulnerability by entering a URL, which can result in the removal or modification of the pathconfig.php file. This can render the entire Contao installation inaccessible or allow for the execution of malicious code. The impact of this vulnerability can be severe, leading to unauthorized access, data breaches, and potential compromise of the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 2.11.172.11.17composer require contao/core:2.11.17 -
>= 3.0.0, < 3.2.93.2.9composer require contao/core:3.2.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed versions as soon as possible to mitigate the risk of exploitation.
Conclusion
The code injection and remote execution vulnerability in contao/core can have severe consequences, including unauthorized access and data breaches. It is crucial to update to the fixed versions (2.11.17 or later for versions 2.x, and 3.2.9 or later for versions 3.x) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for contao/core →
FAQ
contao/core is an open-source content management system (CMS) used for website development.
Versions 2.x prior to 2.11.17 and 3.x prior to 3.2.9 are affected.
Attackers can exploit this vulnerability by entering a URL, allowing them to remove or modify the pathconfig.php file and potentially execute malicious code.
The consequences of this vulnerability can include unauthorized access, data breaches, and compromise of the entire system.
No, there is no known workaround. It is essential to update to the fixed versions to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for contao/core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
