GitHub Security Advisory: GHSA-7jx7-3846-m7w7
Package: craftcms/cms (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
Vulnerable versions: >= 4.0.0-RC1, <= 4.16.17
Patched in: 4.16.18

Summary: Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Details:
## Relationship to Previously Patched Vulnerability

This vulnerability is **in addition to** the RCE vulnerability patched in [GHSA-255j-qw47-wjh5](https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5). That advisory addressed a similar RCE vulnerability that affected two specific routes:

- `/index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings`
- `/index.php?p=admin%2Factions%2Ffields%2Frender-card-preview`

This one addresses some additional endpoints that were not covered in the https://github.com/craftcms/cms/security/advisories/GHSA-255j-qw47-wjh5.

The patched vulnerability used a malicious `AttributeTypecastBehavior` with a wildcard event listener (`"on *": "self::beforeSave"`) and `__construct()` syntax to trigger RCE via the `typecastBeforeSave` callback. The fix was implemented in commits:
- [6e608a1](https://github.com/craftcms/cms/commit/6e608a1a5bfb36943f94f584b7548ca542a86fef)
- [27f5588](https://github.com/craftcms/cms/commit/27f55886098b56c00ddc53b69239c9c9192252c7)
- [ec43c49](https://github.com/craftcms/cms/commit/ec43c497edde0b2bf2e39a119cded2e55f9fe593)

This vulnerability follows the same attack pattern (behavior injection via `"as <behavior>"` syntax) but affects a **different code path** (`assembleLayoutFromPost()` in `Fields.php`) that was **not patched** in those commits. The attack vector uses `typecastAfterValidate` instead of `typecastBeforeSave` and does not require the wildcard event listener syntax, demonstrating that multiple entry points exist for this type of vulnerability.

---

## Executive Summary

A Remote Code Execution (RCE) vulnerability exists in Craft CMS where the `assembleLayoutFromPost()` function in `src/services/Fields.php` fails to sanitize user-supplied configuration data before passing it to `Craft::createObject()`. This allows authenticated administrators to inject malicious Yii2 behavior configurations that execute arbitrary system commands on the server. This vulnerability represents an **unpatched variant** of the behavior injection vulnerability addressed in GHSA-255j-qw47-wjh5, affecting different endpoints through a separate code path.

---

## Vulnerability Details

### Attack Prerequisites

- **Authentication:** Admin-level access required
- **Network Access:** Access to admin panel (`/admin`)

---


### Location

- **File:** `src/services/Fields.php`
- **Function:** `assembleLayoutFromPost()` (lines 1125-1143)
- **Root Cause:** Missing `cleanseConfig()` call on user-supplied `fieldLayout` POST parameter

### Vulnerable Code Path

```php
// src/services/Fields.php:1125-1133
public function assembleLayoutFromPost(?string $namespace = null): FieldLayout
{
    $paramPrefix = $namespace ? rtrim($namespace, '.') . '.' : '';
    $request = Craft::$app->getRequest();
    $config = JsonHelper::decode($request->getBodyParam("{$paramPrefix}fieldLayout"));
    // ... additional config values added ...
    $layout = $this->createLayout($config);  // <-- No cleans