Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-2p2v-3mjg-gfpf (a duplicate of GHSA-957r-qf9p-67xw), describes an arbitrary file read via SplFileObject in non-sandboxed Twig template contexts. The core issue is that the create() Twig function, when used by an authenticated administrator with allowAdminChanges=true, could configure malicious entry type titles or URI formats that instantiate SplFileObject. This is due to an incomplete blocklist for class instantiation.
Analysis of the patch for this vulnerability (commit 353b5d676c88a854c9f6409ad83b837ca0c0e8da for 5.x and its backport 789789dc9e2a4e2f2562f51aaf879fb7757d8340 for 4.x) reveals changes in src/services/Conditions.php. Specifically, the functions createCondition and createConditionRule were modified to incorporate ComponentHelper::cleanseConfig when processing configuration data. Before this patch, these functions directly decoded and used JSON configuration from user input without this crucial sanitization step.
Therefore, in the vulnerable versions, when an administrator configured a malicious entry type title or URI format using the create() Twig function, the craft\services\Conditions.createCondition or craft\services\Conditions.createConditionRule functions would be invoked to process this configuration. Due to the lack of ComponentHelper::cleanseConfig, these functions would then instantiate the SplFileObject class with attacker-controlled file paths, leading to the arbitrary reading of server files. These functions would appear in a runtime profiler during the exploitation of this vulnerability as they are directly responsible for processing the malicious input and performing the unsafe class instantiation.
craft\services\Conditions.createConditionsrc/services/Conditions.php
craft\services\Conditions.createConditionRulesrc/services/Conditions.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | >= 4.0.0-RC1, < 4.18.2 |