Craft CMS Arbitrary System File Read
Date: 2024-11
Affected: composer/craftcms/cms, composer/craftcms/cms
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-52292
CWE: CWE-22
CWE-552
CVSS: 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)

### Summary By abusing the mail notification template it is possible to read arbitrary operating system files. ### Details The [dataUrl](https://craftcms.com/docs/3.x/dev/functions.html#dataurl) function can be exploited if an attacker has write permissions on system notification templates. This function accepts an absolute file path, reads the file's content, and converts it into a Base64-encoded string. By embedding this function within a system notification template, the attacker can exfiltrate the Base64-encoded file content through a triggered system email notification. Once the email is received, the Base64 payload can be decoded, allowing the attacker to read arbitrary files on the server. Requirements: * write permissions to system notification templates * ability to trigger a corresponding system email ### PoC 1) Modify a template to contain the following twig template string: ```twig {{ dataUrl('/var/www/web/.env') }} ``` 2) Trigger the corresponding notification email (e.g. by resetting a password) 3) Receive the email and decode the base64 string Mail received: ![Bildschirmfoto 2024-09-05 um 16 20 41](https://github.com/user-attachments/assets/24dc5196-6847-4006-b7ef-8cd10d659c30) Decoded string: ![Bildschirmfoto 2024-09-05 um 16 28 24](https://github.com/user-attachments/assets/1913a475-5277-49b9-9210-2f3fcd3b9bf1) ### Impact 1) Exposure of Sensitive Information: Arbitrary file read can lead to the exposure of sensitive data such as configuration files (e


Mitigations:

Architectural layers (MAESTRO):