Craft CMS vulnerable to Potential Remote Code Execution via missing path normalization & Twig SSTI

Successful exploitation of CVE-2024-52293 could allow an authenticated administrator to execute arbitrary code on the server hosting the Craft CMS instance. This could lead to complete system compromise, including data exfiltration, modification, or deletion. The attack leverages Twig SSTI, a well-understood attack vector, making it potentially easier for attackers to exploit. Given the post-authentication requirement (ALLOWADMINCHANGES=true), an attacker would need to first gain access to an administrator account, but once achieved, the impact is severe. This vulnerability is a sequel to CVE-2023-40035, indicating a recurring pattern of template injection issues within Craft CMS.

Organizations using Craft CMS with administrator accounts that have not been updated to version 4.12.2 are at risk. Specifically, deployments with ALLOWADMINCHANGES enabled are particularly vulnerable, as this setting facilitates the exploitation process. Shared hosting environments running Craft CMS are also at increased risk due to the potential for cross-site contamination.

• php: Examine Craft CMS application logs for unusual Twig template rendering errors or attempts to access sensitive files.

grep -r 'Twig' /path/to/craftcms/app/logs/*

• php: Check for modifications to Twig template files within the Craft CMS installation directory.

find /path/to/craftcms/app/templates -type f -mtime -1

• generic web: Monitor web server access logs for requests containing suspicious Twig template syntax or attempts to access restricted resources.

curl -I 'http://your-craftcms-site.com/?template=evil'

1. 2024-11-13Disclosure

   disclosure

2. 2024-11-13Patch

   patch

1. 已保留2024-11-06
2. 发布日期2024-11-13
3. 修改日期2026-02-04
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2024-52293 is to upgrade Craft CMS to version 4.12.2 or later. If an immediate upgrade is not possible, consider implementing temporary workarounds. While a direct WAF rule targeting Twig SSTI is complex, ensure your WAF is configured to monitor for suspicious template rendering activity. Review and restrict user input used in Twig templates to minimize the attack surface. After upgrading, confirm the fix by attempting to trigger the SSTI vulnerability via a crafted Twig template; the attempt should fail with an appropriate error message.

最后更新

5.10.3最近