Miggo Logo
Miggo Vulnerability Database
→
CVE-2023-44381

CVE-2023-44381: October CMS safe mode bypass using Page template injection

4.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2023-44381
GHSA ID
GHSA-q22j-5r3g-9hmh
EPSS Score
0.39294%
CWE
CWE-94
Published
11/29/2023
Updated
12/4/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
october/systemcomposer>= 3.0.0, < 3.4.153.4.15

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from improper enforcement of cms.safe_mode restrictions when processing CMS templates. Functions handling template rendering (e.g., renderPage) and backend save operations (e.g., onSave) are critical points where user input could bypass safe mode checks. These functions likely lacked proper validation to strip or block PHP code in templates when safe mode was enabled, allowing crafted payloads to execute. The high confidence stems from the CWE-94 context (code injection) and the workflow described in the advisory, where backend users with template editing permissions exploit these functions to inject PHP.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n *ut**nti**t** ***k*n* us*r wit* t** `**itor.*ms_p***s`, `**itor.*ms_l*youts`, or `**itor.*ms_p*rti*ls` p*rmissions w*o woul* norm*lly not ** p*rmitt** to provi** P*P *o** to ** *x**ut** *y t** *MS *u* to `*ms.s***_mo**` **in* *n**l** *

Reasoning

T** vuln*r**ility st*ms *rom improp*r *n*or**m*nt o* `*ms.s***_mo**` r*stri*tions w**n pro**ssin* *MS t*mpl*t*s. *un*tions **n*lin* t*mpl*t* r*n**rin* (*.*., r*n**rP***) *n* ***k*n* s*v* op*r*tions (*.*., onS*v*) *r* *riti**l points w**r* us*r input