This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Craft CMS suffers from **Remote Code Execution (RCE)** via improper handling of the `--templatesPath` query parameter.β¦
π **Root Cause**: The flaw stems from **CWE-94 (Code Injection)**. Specifically, it exploits the PHP configuration `register_argc_argv` being enabled.β¦
π¦ **Affected Versions**: - Craft CMS **5.0.0-RC1** up to **5.5.2** (before 5.5.2). - Craft CMS **4.0.0-RC** up to **4.13.2** (before 4.13.2). π’ **Vendor**: CraftCMS.
Q4What can hackers do? (Privileges/Data)
π» **Attacker Capabilities**: - **Privileges**: Full **Remote Code Execution (RCE)** as the web server user. - **Data**: Access to all database contents, user credentials, and server files.β¦
βοΈ **Exploitation Threshold**: - **Auth**: **Unauthenticated**. No login required. π - **Config**: Requires `register_argc_argv` to be **enabled** in `php.ini`. This is often default in some environments but not all. π οΈ
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exploits**: **YES**. Multiple PoCs are available on GitHub (e.g., by Chocapikk, Sachinart). Automated scanning templates exist in Nuclei. Wild exploitation is highly likely due to ease of use. π
Q7How to self-check? (Features/Scanning)
π **Self-Check**: - Use **Nuclei** with the CVE-2024-56145 template. - Check if `register_argc_argv` is On in PHP config. - Scan for Craft CMS versions listed above.β¦
π‘οΈ **Official Fix**: **YES**. A patch was released. See GitHub Advisory GHSA-2p6p-9rc9-62j9 and commit `82e893fb794d30563da296bca31379c0df0079b3`. Update to the latest stable version immediately. β
Q9What if no patch? (Workaround)
π§ **Workaround (If No Patch)**: 1. Disable `register_argc_argv` in `php.ini` (set to Off). 2. Restrict access to the `--templatesPath` parameter if possible. 3.β¦
π¨ **Urgency**: **CRITICAL**. - Unauthenticated RCE. - Public PoCs available. - Affects major CMS versions. - Immediate patching or mitigation is required. Do not delay! β³