Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| craftcms/cms | composer | >= 4.0.0-RC1, < 4.18.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-w36c-qxrq-v7fw (a duplicate of GHSA-265m-7826-wjqm), describes an authenticated remote code execution (RCE) in Craft CMS due to a JSON cleanse bypass in the control panel's element-search condition handling. Specifically, Component::cleanseConfig() was applied to the outer request, but Conditions::createCondition() later decoded and merged a JSON string from condition.config without re-running the cleansing process. This allowed Yii special config keys ('as ...', 'on ...') to be hidden within the JSON and then interpreted by Yii as behavior/event configuration during FieldLayout object creation, leading to RCE.
By analyzing the commit 353b5d676c88a854c9f6409ad83b837ca0c0e8da (which is part of the fix for version 5.10.6 and backported to 4.18.2), the changes in src/services/Conditions.php directly address this issue. The createCondition function was modified to apply ComponentHelper::cleanseConfig() to the decoded JSON configuration. Additionally, createConditionRule was also patched to cleanse its $newConfig array, indicating a similar vulnerability path. These modifications ensure that even after JSON decoding, the configuration is properly sanitized, preventing the injection of malicious Yii configuration directives. The craft\web\twig\SecurityPolicy::checkMethodAllowed function was also patched in a related commit (8fe8fb3af0756c11df2cbce7219faef25866c58d) to prevent calling magic methods, which could be part of an RCE chain, but the core vulnerability lies in the un-cleansed configuration processing within the Conditions service.
craft\services\Conditions::createConditionsrc/services/Conditions.php
craft\services\Conditions::createConditionRulesrc/services/Conditions.php
PHPPHP