CVE-2021-44618

Vulnerability

A Server-side Template Injection (SSTI) vulnerability exists in Nystudio107 Seomatic 3.4.12, a Craft CMS plugin. The flaw resides in the src/helpers/UrlHelper.php file, where the siteUrl and absoluteUrlWithProtocol functions fail to sanitize URL components derived from the Host HTTP header. An attacker can inject Twig template syntax into the host header, which is then processed by the server without proper escaping [1][2].

Exploitation

An attacker can exploit this vulnerability by sending an HTTP request to a Craft CMS site running the vulnerable plugin with a crafted Host header containing a malicious Twig template payload. No authentication is required, and the attack can be performed remotely over the network. The server processes the injected template code during URL generation, leading to server-side template execution [1][3].

Impact

Successful exploitation allows the attacker to achieve remote code execution (RCE) on the server. The attacker can execute arbitrary Twig templates, which in Craft CMS can lead to complete compromise of the application, including data exfiltration, privilege escalation, and persistent backdoor installation [1][3].

Mitigation

The vulnerability is fixed in commit 0c5c0c0e0cb61000d12ec55ebf174745a5bf6469, which applies DynamicMeta::sanitizeUrl() to the output of the affected functions [4]. Users should upgrade to a version of the plugin that includes this patch; as of the publication date, the latest stable release (3.4.12) is vulnerable, so applying the commit or updating to any subsequent release is recommended. No workaround is documented [2][4].