Craft CMS Authenticated RCE via signed-cookie/redirect confusion (CVE-1326)

Vulnerability Summary: Authenticated RCE through signed-cookie/redirect confusion Vulnerability Overview Vulnerability Name: Authenticated RCE through signed-cookie/redirect confusion CVE ID: CVE-1326 Severity: High Description: Craft signs an attacker-controllable cookie for authenticated users, using the same key and format as the cookie used to verify the signed parameter. An attacker can exploit this confusion by passing the cookie's value as the parameter. Upon successful login, Craft verifies the signature and redirects to a sanitized Twig expression, allowing PHP to execute arbitrary commands. This can be triggered by non-administrator accounts without access to the Control Panel. Affected Scope Affected Package: craftcms/cms (Composer) Affected Versions: >= 4.0.0 = 5.10.13 Fixed Version (Alternative Range): 5.10.13 Impact: Authenticated low-privilege attackers can execute arbitrary operating system commands (as the PHP/Web server user), expose application secrets and data, and modify writable files or device services. Prerequisites A valid Craft account using password authentication with 2FA disabled The account must have access to the live site, or returns true when the system is offline Default request configuration uses , while signed request parameters use Craft's PHP and or commands are available on the server Root Cause copies the request's body parameter to the response cookie. This requires admin privileges ( ) and signs the serialized cookie as ( ; ). Craft configures Yii's and uses Craft's for signing request parameters ( ; ). The signature is not bound to its specific purpose. After login, the returned by is processed via ( ). This path validates the parameter and then passes the authentication type to ( ; ). The renderer uses an unsanitized Twig expression to invoke ( ). Remediation Upgrade to 4.18.6 or 5.10.13 or later. POC / Exploitation Code The page does not contain a standalone POC code block, but the critical exploitation path involves the following code locations (file line number references, not complete code blocks):

Goal Reached Thanks to every supporter — we hit 100%!

Craft CMS Authenticated RCE via signed-cookie/redirect confusion (CVE-1326)

More from this source