Log in / Sign up

Vulnerability details

CVE-2024-52291

craftcms cmscraftcms craft_cms

Craft has a Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution

CVSS 3.1
8.5High

Official description

Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5.

CVSS scores

ScoreVersionSourceVector
8.5High 3.1 CVEProject cvelistV5 (CNA) (GitHub_M) CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Affected products

VendorProductVersionsSource
craftcms cms >= 4.0.0-RC1, < 4.12.5 CVEProject cvelistV5 (CNA)
craftcms cms >= 5.0.0-RC1, < 5.4.6 CVEProject cvelistV5 (CNA)
craftcms craft_cms v ≤ 5.0.0-RC1 CISA ADP / Vulnrichment
craftcms craft_cms v < 5.4.6 CISA ADP / Vulnrichment
craftcms craft_cms v ≤ 4.0.0-RC1 CISA ADP / Vulnrichment
craftcms craft_cms v < 4.12.5 CISA ADP / Vulnrichment

References and advisories

1
Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published
2024-11-13
Last updated
2024-11-13
State
Published
Assigner (CNA)
GitHub_M

Exploit prediction (EPSS)

1.25%
Probability of exploitation in 30 days
69.6%
Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable
No
Exploitation
Proof of concept
Technical impact
Total

Weaknesses (CWE)

  • CWE-22
    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')