CVE-2021-37626
📋 TL;DR
This vulnerability allows untrusted back-end users in Contao CMS to execute arbitrary PHP code via insert tags. It affects installations where back-end users with content editing permissions can modify fields displayed in the front end. The vulnerability enables PHP file inclusion attacks.
💻 Affected Systems
- Contao CMS
📦 What is this software?
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
Contao by Contao
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or website defacement
Likely Case
Unauthorized PHP code execution allowing back-end privilege escalation and content manipulation
If Mitigated
Limited impact if only trusted users have back-end access or insert tags are properly sanitized
🎯 Exploit Status
Exploitation requires back-end user credentials with content editing permissions
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.56, 4.9.18, or 4.11.7
Vendor Advisory: https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html
Restart Required: No
Instructions:
1. Backup your Contao installation and database. 2. Update to Contao 4.4.56, 4.9.18, or 4.11.7 via Composer or manual update. 3. Clear the cache. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict back-end access
allDisable login for untrusted back-end users to prevent exploitation
Sanitize insert tags
allImplement input validation to filter malicious insert tags in content fields
🧯 If You Can't Patch
- Immediately revoke back-end access for all untrusted users
- Implement strict input validation on all content fields that accept insert tags
🔍 How to Verify
Check if Vulnerable:
Check Contao version via admin panel or by examining the composer.json fileCheck Version:
php vendor/contao/core-bundle/src/ContaoCoreBundle.php --versionVerify Fix Applied:
Confirm version is 4.4.56, 4.9.18, or 4.11.7 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual PHP file inclusion attempts in web server logs
- Suspicious insert tag patterns in content updates
Network Indicators:
- Unexpected PHP file requests containing insert tag patterns
SIEM Query:
web_access_logs WHERE uri CONTAINS 'insert_tags' AND uri CONTAINS '.php'🔗 References
- https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html
- https://github.com/contao/contao/security/advisories/GHSA-r6mv-ppjc-4hgr
- https://contao.org/en/security-advisories/php-file-inclusion-via-insert-tags.html
- https://github.com/contao/contao/security/advisories/GHSA-r6mv-ppjc-4hgr
