CVE-2021-27903
📋 TL;DR
CVE-2021-27903 is a remote code execution vulnerability in Craft CMS that allows attackers to execute arbitrary code on affected systems. This vulnerability affects Craft CMS installations where administrative changes are not restricted, requiring an attacker to hijack an administrator's session. Sites running Craft CMS versions before 3.6.7 are vulnerable.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the web server, potentially leading to data theft, malware deployment, or lateral movement within the network.
Likely Case
Attacker executes arbitrary code on the web server, potentially compromising the CMS installation, accessing sensitive data, or defacing the website.
If Mitigated
Limited impact with proper session security and administrative restrictions in place, though the vulnerability still exists in the codebase.
🎯 Exploit Status
Exploitation requires administrative privileges or session hijacking. No public proof-of-concept has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.7 and later
Vendor Advisory: https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
Restart Required: No
Instructions:
1. Backup your Craft CMS installation and database. 2. Update Craft CMS to version 3.6.7 or later via Composer: 'composer require craftcms/cms:^3.6.7'. 3. Clear caches and verify the update.
🔧 Temporary Workarounds
Restrict Administrative Access
allImplement strict access controls and session management for administrative accounts
Implement Web Application Firewall
allDeploy WAF rules to detect and block suspicious administrative actions
🧯 If You Can't Patch
- Implement strict session management with short timeouts and IP validation
- Restrict administrative access to specific IP addresses or VPN-only access
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via 'composer show craftcms/cms' commandCheck Version:
composer show craftcms/cms | grep versionVerify Fix Applied:
Verify version is 3.6.7 or higher and check CHANGELOG for security fixes applied📡 Detection & Monitoring
Log Indicators:
- Unusual administrative actions from unexpected IPs
- Suspicious file uploads or code execution attempts in logs
Network Indicators:
- Unexpected outbound connections from web server
- Suspicious payloads in HTTP requests to admin endpoints
SIEM Query:
source="web_logs" AND (uri="/admin/*" OR user_agent="*admin*") AND status=200 AND src_ip NOT IN [allowed_admin_ips]🔗 References
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security
- https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#367---2021-02-23
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#security
- https://github.com/craftcms/cms/commit/c17728fa0bec11d3b82c34defe0930ed409aec38
