GHSA-vqxf-r9ph-cc9c: Craft CMS vulnerable to Remote Code Execution via unrestricted file extension
SummaryUnrestricted file extension lead to a potential Remote Code Execution
(Authenticated, ALLOW_ADMIN_CHANGES=true)DetailsVulnerability Cause :If the name parameter value is not empty string('') in the View.php's doesTemplateExist() -> resolveTemplate() -> _resolveTemplateInternal() -> _resolveTemplate() function, it returns directly without extension verification, so that arbitrary extension files are rendered as twig templates (even if they are not extensions set in defaultTemplateExtensions = ['html', 'twig'])When attacker with admin privileges on the DEV or Misconfigured STG, PROD, they can exploit this vulnerability to remote code execution **(ALLOW_ADMIN_CHANGES=true)**PoC**Step 1)** Create a new filesystem. **Base Path: /var/www/html/templates**
![1](https://user-images.githubusercontent.com/30969523/228049254-6c3a9897-c26a-46a5-96ad-41c7b769116a.png)**Step 2)** Create a new asset volume. **Asset Filesystem: template**
![2](https://user-images.githubusercontent.com/30969523/228049839-d2d42245-fa6e-4245-9fd2-967f1b9f4a74.png)**Step 3)** Upload poc file( .txt , .js , .json , etc ) with twig template rce payload![7](https://user-images.githubusercontent.com/30969523/228051307-623b78d0-4792-44ae-af0f-aff6b16f8d87.png)
![5](https://user-images.githubusercontent.com/30969523/228051064-cfaad338-3aff-4c4f-a177-9b42e473142b.png)**Step 4)** Create a new global set with template layout. The template filename is poc.js
![8](https://user-images.githubusercontent.com/30969523/228051430-365457eb-2a10-47a8-aed9-fb400e80c6d5.png)**Step 5)** When access global menu or /admin/global/test, poc.js is rendered as a template file and RCE confirmed
![9](https://user-images.githubusercontent.com/30969523/228053142-62a0f1ad-bbfa-4b8d-b6bd-28ed26c1cc18.png)**Step 6)** RCE can be confirmed on other menus(Entries, Categories) where the template file is loaded.
![10](https://user-images.githubusercontent.com/30969523/228054216-5dcd0c30-85bd-4603-84e5-944cfe9ad93c.png)
![11](https://user-images.githubusercontent.com/30969523/228054146-d5a3ceea-e13d-461a-bcd6-abf260761d62.png)**Poc Environment)** ALLOW_ADMIN_CHANGES=true, defaultTemplateExtensions=['html','twig']
![0](https://user-images.githubusercontent.com/30969523/228054764-37d78cf5-5eca-442f-873a-99e6676b8173.png)
![13](https://user-images.githubusercontent.com/30969523/228054803-1a2c40b0-e515-46b3-a653-bb5ef1a287a2.png)
![14](https://user-images.githubusercontent.com/30969523/228054821-c7b0cfd6-126a-4722-846c-26d725af1a6a.png)ImpactTake control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc.Additionally, there are 371 domains using CraftCMS exposed on Shodan, and among them, 33 servers have "stage" or "dev" included in their hostnames.although the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution)![2023-03-31 10 29 53](https://user-images.githubusercontent.com/30969523/229001176-4c235b2f-e1a3-4b96-965a-78f227546a12.png)RemediationRecommend taking measures by referring to https://github.com/craftcms/cms-ghsa-9f84-5wpf-3vcf/pull/1![remediation](https://user-images.githubusercontent.com/30969523/228841202-43079754-0d9d-47fa-8ae3-ce5dd509796b.png)
CVSS v3.1: 7.2