PHP file inclusion via insert tags

Vulnerability

In Contao versions prior to 4.4.56, 4.9.18, and 4.11.7, a vulnerability exists in the handling of insert tags. An attacker with untrusted back end user privileges can load PHP files by entering malicious insert tags in fields that are displayed in the front end [1].

Exploitation

To exploit, an attacker must be an untrusted back end user with permissions to modify fields that are rendered in the front end. By crafting an insert tag containing a PHP file path, the application loads and executes the file. The exact mechanism requires knowledge of the insert tag syntax but no additional authentication beyond the user's existing privileges [1].

Impact

Successful exploitation allows arbitrary PHP file loading and execution, leading to remote code execution with the web application's privileges. This can result in full compromise of the CMS, including data exposure, modification, or further attacks [1].

Mitigation

Update to Contao 4.4.56, 4.9.18, or 4.11.7, which contain the fix [1][3][4]. If immediate update is not possible, disable login for untrusted back end users as a workaround [1].