Database Backup Triggered by Unauthenticated Users in Craft CMS - High Severity Vulnerability
Summary
GHSA-v64r-7wg9-23pr: Unauthenticated Craft CMS users can trigger a database backup. Affects craftcms/cms across 2 version ranges.
>= 3.0.0, < 4.16.17
>= 5.0.0-RC1, < 5.8.21
Fixed in 4.16.17 or 5.8.21, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Craft CMS is a flexible content management system designed for creating and managing websites. It offers a user-friendly interface, powerful features, and a robust architecture that supports various content types and structures. However, a recent vulnerability has been identified that allows unauthenticated users to trigger database backup operations, potentially leading to resource exhaustion or information disclosure.
Vulnerability Detail
The vulnerability arises from certain admin actions in Craft CMS being configured with anonymous access, allowing unauthenticated users to send POST requests to specific endpoints. This can lead to unauthorized database backup operations if the 'backupOnUpdate' feature is enabled. The root cause is found in the AppController and BaseUpdaterController, where the allowAnonymous property is set to allow unauthenticated access. The attack vector involves sending a crafted request to trigger a database backup, which can result in high CPU and disk usage during the backup process, and potentially expose sensitive information if the backup command is misconfigured.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 3.0.0, < 4.16.174.16.17composer require craftcms/cms:4.16.17 -
>= 5.0.0-RC1, < 5.8.215.8.21composer require craftcms/cms:5.8.21
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the 'backupOnUpdate' feature in your configuration file to prevent unauthorized backups until you can apply the patch. This can be done by setting 'backupOnUpdate' to false in your Craft CMS config.
Conclusion
In summary, the identified vulnerability in Craft CMS allows unauthenticated users to trigger database backups, posing significant risks to system resources and data security. Users are strongly advised to update to the latest patched versions and consider temporary workarounds to mitigate the risks until the update can be applied.
See every vulnerability recorded for craftcms/cms →
FAQ
The vulnerability has a CVSS score of 7.0, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The risks include unauthorized database backups, resource exhaustion, and potential exposure of sensitive information.
Yes, updating to the patched versions of Craft CMS and disabling the 'backupOnUpdate' feature can help mitigate the risk.
If an immediate update is not possible, consider disabling the 'backupOnUpdate' feature in your configuration as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for craftcms/cms.
