Craft is affected by potential authenticated Remote Code Execution via Twig SSTI

Vulnerability

Overview

Craft CMS versions prior to 5.8.22 and 4.16.18 contain a server-side template injection (SSTI) vulnerability that can lead to remote code execution (RCE). The flaw resides in the Twig map filter, which can be abused when processing Twig input in certain administrative text fields. Specifically, an attacker can craft a malicious payload using the map filter within the Settings area of the Craft control panel or via the System Messages utility [1][2].

Exploitation

Prerequisites

Exploitation requires authenticated access to the Craft control panel. Two attack scenarios exist: an administrator account with allowAdminChanges enabled (which is discouraged for non-development environments), or a non-administrator account that has access to the System Messages utility even when allowAdminChanges is disabled [2][4]. The allowAdminChanges setting is a security hardening measure that, when set to false, prevents changes to system settings via the control panel [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server. This could lead to full compromise of the Craft CMS installation, including data exfiltration, modification of content, or further lateral movement within the hosting environment [2][4].

Mitigation

The Craft CMS team has released patched versions 5.8.22 and 4.16.18 to address this vulnerability. Users are strongly advised to update immediately. Additionally, following security best practices such as disabling allowAdminChanges in production environments and restricting access to the System Messages utility can reduce the attack surface [1][2][4].