CVE-2021-44618
📋 TL;DR
This CVE describes a Server-side Template Injection (SSTI) vulnerability in Nystudio107 Seomatic plugin for Craft CMS. Attackers can exploit this by manipulating the Host header to inject malicious template code, potentially leading to remote code execution. All systems running vulnerable versions of the Seomatic plugin are affected.
💻 Affected Systems
- Nystudio107 Seomatic plugin for Craft CMS
📦 What is this software?
Seomatic by Nystudio107
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Remote code execution allowing attackers to execute arbitrary commands on the server, potentially leading to data exfiltration or further system compromise.
If Mitigated
Limited impact with proper input validation and security controls, potentially only causing denial of service or information disclosure.
🎯 Exploit Status
Exploitation requires only HTTP request manipulation. The vulnerability is in a widely used plugin, making it attractive for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.12 and later
Vendor Advisory: https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12
Restart Required: No
Instructions:
1. Update Seomatic plugin to version 3.4.12 or later via Craft CMS admin panel or Composer. 2. Verify the update was successful by checking the plugin version. 3. Clear any caches if necessary.
🔧 Temporary Workarounds
Host Header Validation
allImplement web application firewall rules or middleware to validate and sanitize Host headers
Input Sanitization
allAdd custom validation for all user-controlled inputs in template rendering
🧯 If You Can't Patch
- Implement strict input validation for Host headers at the web server or application level
- Deploy web application firewall with SSTI protection rules
🔍 How to Verify
Check if Vulnerable:
Check Seomatic plugin version in Craft CMS admin panel or via Composer: composer show nystudio107/craft-seomaticCheck Version:
composer show nystudio107/craft-seomatic | grep versionsVerify Fix Applied:
Verify Seomatic plugin version is 3.4.12 or higher and check the commit hash matches the fix📡 Detection & Monitoring
Log Indicators:
- Unusual Host header values in web server logs
- Multiple failed template rendering attempts
- Suspicious PHP/system commands in logs
Network Indicators:
- HTTP requests with manipulated Host headers containing template syntax
- Unusual outbound connections from web server
SIEM Query:
source="web_server_logs" AND (Host:*{{* OR Host:*}}* OR Host:*$*{*)🔗 References
- https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469
- https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12
- https://github.com/nystudio107/craft-seomatic/commit/0c5c0c0e0cb61000d12ec55ebf174745a5bf6469
- https://github.com/nystudio107/craft-seomatic/releases/tag/3.4.12
