Loading vulnerability…
Unauthenticated remote code execution in Craft CMS
CVE-2024-56145 is an unauthenticated remote code execution vulnerability in Craft CMS when PHP's register_argc_argv setting is enabled. During web requests, PHP populates its argument array from query-string values, and Craft CMS's App::cliOption function processes these arguments without verifying that execution is occurring through the CLI SAPI. An attacker can override the templatesPath configuration to retrieve an attacker-controlled Twig template through the FTP stream wrapper. A callback-restriction bypass involving the Twig sort filter and call_user_func enables arbitrary command execution during template rendering.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthenticated execution of arbitrary PHP code and system commands on the Craft CMS server. Potential application-level consequences include website content manipulation and acquisition of administrator privileges. Active exploitation has been observed, including exploitation by Earth Lamia.
If you can’t patch tonight, do this now.
If upgrading is not immediately possible, disable PHP's register_argc_argv setting by setting it to Off in the PHP configuration used by the Craft CMS deployment.
Patch, then assume compromise.
Upgrade Craft CMS to the fixed release for the applicable major version: 3.9.14, 4.13.2, or 5.5.2, or a later supported release.
3 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.