Craft Potential Remote Code Execution via Twig SSTI

Vulnerability

Overview

Craft CMS, a platform for creating digital experiences, contains a remote code execution vulnerability arising from Twig Server-Side Template Injection (SSTI). This issue affects versions 4.0.0-RC1 through 4.16.5 and 5.0.0-RC1 through 5.8.6, and is a follow-up to CVE-2024-52293. The root cause involves missing path normalization in the FileHelper::absolutePath function, which can allow an attacker to bypass system directory checks and inject malicious Twig templates [1][3].

Attack

Vector and Prerequisites

The vulnerability can be exploited post-authentication, and requires the ALLOW_ADMIN_CHANGES configuration to be set to true. The missing normalization in FileHelper::absolutePath (in src/helpers/FileHelper.php) leads to security risks, specifically in src/services/Security.php where the isSystemDir method fails to properly recognize paths like ../templates/poc as system directories. This allows an authenticated attacker to write or modify templates in locations that should be restricted, ultimately enabling Twig SSTI [2][3].

Impact

Successful exploitation allows an authenticated attacker with sufficient privileges to achieve remote code execution on the server. By injecting malicious Twig code, the attacker can execute arbitrary PHP functions, potentially leading to full server compromise, data exfiltration, or further internal network attacks.

Mitigation

The vulnerability has been patched in Craft CMS versions 4.16.6 and 5.8.7. Users are strongly advised to upgrade to these patched versions immediately. No workarounds are mentioned in the advisories, but restricting ALLOW_ADMIN_CHANGES and limiting administrative access can reduce the risk [3][1].