CVE-2021-27230
📋 TL;DR
This vulnerability allows authenticated users with translation permissions to inject arbitrary PHP code into language files in ExpressionEngine CMS. Successful exploitation leads to remote code execution on the web server. All ExpressionEngine installations with vulnerable versions and authenticated users having translation access are affected.
💻 Affected Systems
- ExpressionEngine CMS
📦 What is this software?
Expressionengine by Expressionengine
Expressionengine by Expressionengine
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, malware deployment, lateral movement to other systems, and complete site defacement.
Likely Case
Attacker gains web server user privileges, can read/write files, execute commands, and potentially escalate to higher privileges.
If Mitigated
With proper access controls limiting translation permissions, impact is reduced to authorized users only, but still dangerous if those accounts are compromised.
🎯 Exploit Status
Exploit requires authenticated access. Public exploit code available on Packet Storm and other sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ExpressionEngine 5.4.2, ExpressionEngine 6.0.3
Vendor Advisory: https://expressionengine.com/features
Restart Required: No
Instructions:
1. Backup your site and database. 2. Update to ExpressionEngine 5.4.2 or 6.0.3 via admin panel or manual download. 3. Clear cache. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Restrict Translation Permissions
allRemove translation permissions from all non-essential users to limit attack surface.
File System Permissions
linuxSet read-only permissions on system/user/language directory to prevent file writes.
chmod -R 444 /path/to/system/user/language
🧯 If You Can't Patch
- Immediately remove translation permissions from all users except absolutely necessary administrators.
- Implement web application firewall rules to block requests to Translate::save() function from non-privileged users.
🔍 How to Verify
Check if Vulnerable:
Check ExpressionEngine version in admin panel or via system/ee/legacy/config/version.php file.Check Version:
cat /path/to/system/ee/legacy/config/version.php | grep "app_version"Verify Fix Applied:
Confirm version is 5.4.2 or higher for EE5, or 6.0.3 or higher for EE6.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to translation endpoints
- File writes to _lang.php files in system/user/language directory
- Suspicious PHP code in language files
Network Indicators:
- HTTP requests containing PHP code in translation parameters
- Unusual file upload patterns to language directories
SIEM Query:
source="web_logs" AND (uri="/admin.php?/cp/design/language/save" OR uri CONTAINS "Translate::save") AND status=200🔗 References
- http://karmainsecurity.com/KIS-2021-03
- http://packetstormsecurity.com/files/161805/ExpressionEngine-6.0.2-PHP-Code-Injection.html
- http://seclists.org/fulldisclosure/2021/Mar/32
- https://expressionengine.com/features
- https://hackerone.com/reports/1093444
- http://karmainsecurity.com/KIS-2021-03
- http://packetstormsecurity.com/files/161805/ExpressionEngine-6.0.2-PHP-Code-Injection.html
- http://seclists.org/fulldisclosure/2021/Mar/32
- https://expressionengine.com/features
- https://hackerone.com/reports/1093444
