Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

Successful exploitation of CVE-2024-52293 could allow an authenticated administrator to execute arbitrary code on the server hosting the Craft CMS instance. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The attack leverages Twig SSTI, a well-understood attack vector, making it potentially easier for attackers to exploit. Given the post-authentication requirement (ALLOWADMINCHANGES=true), an attacker would need to first gain access to an administrator account, but once achieved, the impact is severe. This vulnerability is a sequel to CVE-2023-40035, indicating a recurring pattern of template injection issues within Craft CMS.

Organizations using Craft CMS with administrator accounts that have not been updated to version 4.12.2 are at risk. Specifically, deployments with ALLOWADMINCHANGES enabled are particularly vulnerable, as this setting facilitates the exploitation process. Shared hosting environments running Craft CMS are also at increased risk due to the potential for cross-site contamination.

• php: Examine Craft CMS application logs for unusual Twig template rendering errors or attempts to access sensitive files.

grep -r 'Twig' /path/to/craftcms/app/logs/*

• php: Check for modifications to Twig template files within the Craft CMS installation directory.

find /path/to/craftcms/app/templates -type f -mtime -1

• generic web: Monitor web server access logs for requests containing suspicious Twig template syntax or attempts to access restricted resources.

curl -I 'http://your-craftcms-site.com/?template=evil'

1. 2024-11-13Disclosure

   disclosure

2. 2024-11-13Patch

   patch

1. आरक्षित2024-11-06
2. प्रकाशित2024-11-13
3. संशोधित2026-02-04
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-52293 is to upgrade Craft CMS to version 4.12.2 or later. If an immediate upgrade is not possible, consider implementing temporary workarounds. While a direct WAF rule targeting Twig SSTI is complex, ensure your WAF is configured to monitor for suspicious template rendering activity. Review and restrict user input used in Twig templates to minimize the attack surface. After upgrading, confirm the fix by attempting to trigger the SSTI vulnerability via a crafted Twig template; the attempt should fail with an appropriate error message.

अंतिम अपडेट

5.10.3हाल ही में