CVE-2023-41892
📋 TL;DR
CVE-2023-41892 is a critical remote code execution vulnerability in Craft CMS that allows attackers to execute arbitrary code on affected systems. This affects all Craft CMS installations before version 4.4.15. The vulnerability stems from improper input validation that enables code injection attacks.
💻 Affected Systems
- Craft CMS
📦 What is this software?
Craft Cms by Craftcms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the web server, allowing data theft, malware deployment, and lateral movement within the network.
Likely Case
Attackers deploy web shells, steal sensitive data, deface websites, or use the compromised server for cryptocurrency mining or botnet activities.
If Mitigated
With proper network segmentation and least privilege principles, impact could be limited to the web application layer, preventing lateral movement to other systems.
🎯 Exploit Status
Public exploit code is available on Packet Storm Security. The vulnerability requires no authentication and has low attack complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.4.15
Vendor Advisory: https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical
Restart Required: No
Instructions:
1. Backup your Craft CMS installation and database. 2. Update Craft CMS to version 4.4.15 or later via Composer: 'composer require craftcms/cms:^4.4.15'. 3. Run any required database migrations. 4. Clear caches and verify the update.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy a WAF with rules to block code injection patterns and suspicious PHP function calls.
Disable PHP Execution in Upload Directories
linuxConfigure web server to prevent PHP execution in upload and temporary directories.
For Apache: Add 'php_flag engine off' to .htaccess in vulnerable directories
For Nginx: Add 'location ~ \.php$ { deny all; }' to vulnerable directory config
🧯 If You Can't Patch
- Isolate the vulnerable system in a separate network segment with strict firewall rules limiting inbound and outbound connections.
- Implement strict file integrity monitoring and real-time alerting for any file modifications in the web directory.
🔍 How to Verify
Check if Vulnerable:
Check Craft CMS version in admin panel or via 'composer show craftcms/cms' command. If version is below 4.4.15, system is vulnerable.Check Version:
composer show craftcms/cms | grep versionsVerify Fix Applied:
Confirm version is 4.4.15 or higher via admin panel or 'composer show craftcms/cms'. Test that previously vulnerable endpoints no longer accept malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests with PHP code patterns
- Unexpected file creation in web directories
- Suspicious process execution from web user context
- Multiple failed exploitation attempts
Network Indicators:
- Outbound connections to suspicious IPs from web server
- Unusual traffic patterns to/from web server
- Command and control beaconing behavior
SIEM Query:
source="web_server_logs" AND ("php://" OR "system(" OR "exec(" OR "shell_exec(" OR suspicious_file_upload_patterns)🔗 References
- http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical
- https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857
- https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e
- https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1
- https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476
- https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g
- http://packetstormsecurity.com/files/176303/Craft-CMS-4.4.14-Remote-Code-Execution.html
- https://github.com/craftcms/cms/blob/develop/CHANGELOG.md#4415---2023-07-03-critical
- https://github.com/craftcms/cms/commit/7359d18d46389ffac86c2af1e0cd59e37c298857
- https://github.com/craftcms/cms/commit/a270b928f3d34ad3bd953b81c304424edd57355e
- https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1
- https://github.com/craftcms/cms/commit/c0a37e15cc925c473e60e27fe64054993b867ac1#diff-47dd43d86f85161944dfcce2e41d31955c4184672d9bd9d82b948c6b01b86476
- https://github.com/craftcms/cms/security/advisories/GHSA-4w8r-3xrw-v25g
