Craft CMS RCE exploit chain used in zero-day attacks to steal data

Two vulnerabilities impacting Craft CMS were chained together in zero-day attacks to breach servers and steal data, with exploitation ongoing, according to CERT Orange Cyberdefense. The vulnerabilities were discovered by Orange Cyberdefense's CSIRT, which was called in to investigate a compromised server. As part of the investigation, they discovered that two zero-day vulnerabilities impacting Craft CMS were exploited to breach the server: According to a report by SensePost, the ethical hacking team of Orange Cyberdefense, the threat actors chained both of these vulnerabilities together to breach servers and upload a PHP file manager. The attack begins with the exploitation of CVE-2025-32432, which allows attackers to send a specially crafted request containing a "return URL" as a parameter that is saved in a PHP session file. This session name is sent to the visitor as part of the response to the HTTP request. The second stage of the attack leveraged a flaw in the Yii framework (CVE-2024-58136), which Craft CMS utilizes. To exploit this flaw, the attacker sent a malicious JSON payload that caused the PHP code in the session file to be executed on the server. This allowed the attacker to install a PHP-based file manager on the server to compromise the system further. Orange told BleepingComputer that they saw additional compromise steps, including additional uploads of backdoors and data exfiltration. More information about this post-exploitation activity will be detailed in...