CVE-2021-41749
📋 TL;DR
CVE-2021-41749 is a critical Server-Side Template Injection vulnerability in the SEOmatic plugin for Craft CMS that allows unauthenticated attackers to execute arbitrary code on affected servers. This affects all Craft CMS 3 installations using SEOmatic plugin versions up to 3.4.11. The vulnerability enables complete system compromise through remote code execution.
💻 Affected Systems
- Craft CMS SEOmatic Plugin
📦 What is this software?
Seomatic by Nystudio107
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover with attacker gaining full control of the web server, accessing sensitive data, installing malware, and using the server as a pivot point to attack internal networks.
Likely Case
Attackers deploy web shells, steal sensitive data including database credentials and user information, deface websites, or install cryptocurrency miners.
If Mitigated
With proper network segmentation and least privilege principles, impact could be limited to the web application layer, though data breach would still occur.
🎯 Exploit Status
Exploitation requires no authentication and has been weaponized in the wild. Attackers can send specially crafted HTTP requests to vulnerable endpoints.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SEOmatic plugin version 3.4.12 and later
Vendor Advisory: https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
Restart Required: No
Instructions:
1. Log into Craft CMS admin panel. 2. Navigate to Settings → Plugins. 3. Find SEOmatic plugin and click 'Update' if available. 4. Alternatively, manually update via Composer: 'composer update nystudio107/craft-seomatic'. 5. Verify version is 3.4.12 or higher.
🔧 Temporary Workarounds
Disable SEOmatic Plugin
allTemporarily disable the vulnerable plugin until patching is possible
Navigate to Craft CMS admin → Settings → Plugins → SEOmatic → Disable
Web Application Firewall Rule
allBlock requests containing template injection payloads
Add WAF rule to block requests containing '{{' and template engine functions
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the vulnerable server
- Deploy a web application firewall with specific rules to block SSTI payloads
🔍 How to Verify
Check if Vulnerable:
Check SEOmatic plugin version in Craft CMS admin panel under Settings → Plugins, or check composer.json for 'nystudio107/craft-seomatic' versionCheck Version:
php craft plugin/list | grep -i seomaticVerify Fix Applied:
Confirm SEOmatic plugin version is 3.4.12 or higher in Craft CMS admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to SEOmatic endpoints
- Requests containing template syntax like '{{' or payloads with system()/exec() calls
- Sudden increase in error logs from template engine
Network Indicators:
- HTTP requests with unusual parameters to /actions/seomatic/* endpoints
- Outbound connections from web server to suspicious IPs post-exploitation
SIEM Query:
source="web_logs" AND (uri_path="/actions/seomatic/*" AND (request_body CONTAINS "{{" OR request_body CONTAINS "exec(" OR request_body CONTAINS "system("))🔗 References
- https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
- https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d
- https://github.com/nystudio107/craft-seomatic/blob/develop/CHANGELOG.md
- https://github.com/nystudio107/craft-seomatic/commit/3fee7d50147cdf3f999cfc1e04cbc3fb3d9f2f7d
