CVE-2024-56145: Craft CMS Code Injection Vulnerability
Impact You are affected if your php.ini configuration has registerargcargv enabled.
Patches Update to 3.9.14, 4.13.2, or 5.5.2.
Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue.
Other sources
Craft CMS contains a code injection vulnerability. Users with affected versions are vulnerable to remote code execution if their php.ini configuration has registerargcargv enabled.
— CISA
Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has registerargcargv enabled. For these users an unspecified remote code execution vector is present. Users are advised to update to version 3.9.14, 4.13.2, or 5.5.2. Users unable to upgrade should disable registerargcargv to mitigate the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 3.9.14 - Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 4.13.2 - Upgrade
Upgrade
composer/craftcms/cmsto a version that resolves this vulnerability.Fixed in 5.5.2 - Remove
Remove
composer/craftcms/cmsfrom your environment.Discontinue use or uninstall the product if mitigations are unavailable.
- Configuration
Disable register_argc_argv in php.ini to mitigate the code injection / RCE vulnerability if you cannot yet upgrade.
PHP (php.ini) register_argc_argv = Off - Compensating control
Apply mitigations per vendor instructions and follow applicable BOD 22-01 guidance for cloud services if you cannot upgrade immediately.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56145?
CVE-2024-56145 is considered a significant vulnerability, particularly if the php.ini configuration has `register_argc_argv` enabled.
How do I fix CVE-2024-56145?
To fix CVE-2024-56145, update your Craft CMS to version 3.9.14, 4.13.2, or 5.5.2.
What software is affected by CVE-2024-56145?
CVE-2024-56145 affects Craft CMS versions below 3.9.14, 4.13.2, and 5.5.2.
What should I do if I cannot upgrade to fix CVE-2024-56145?
If unable to upgrade, mitigate CVE-2024-56145 by disabling `register_argc_argv` in your php.ini configuration.
Why is CVE-2024-56145 a concern for my website?
CVE-2024-56145 is a concern as it can lead to security vulnerabilities that could allow unauthorized access or manipulation of your Craft CMS.