CVE-2023-47129
📋 TL;DR
This vulnerability allows attackers to upload malicious PHP files disguised as images through front-end forms in Statamic CMS. It affects websites using Statamic's Forms feature with asset upload fields. Only versions before 3.4.13 and 4.33.0 are vulnerable.
💻 Affected Systems
- Statamic CMS
📦 What is this software?
Statamic by Statamic
Statamic by Statamic
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete server compromise, data theft, or website defacement.
Likely Case
Attackers upload web shells to gain persistent access and execute arbitrary commands on the server.
If Mitigated
If proper file validation is implemented, malicious uploads are blocked with no impact.
🎯 Exploit Status
Exploitation requires a form with file upload capability. No authentication needed if form is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.13 or 4.33.0
Vendor Advisory: https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
Restart Required: No
Instructions:
1. Update Statamic via Composer: 'composer update statamic/cms'. 2. For version 3.x, ensure you're on 3.4.13+. 3. For version 4.x, ensure you're on 4.33.0+.
🔧 Temporary Workarounds
Disable file uploads on public forms
allTemporarily remove or disable asset upload fields from front-end forms until patched.
Implement server-side file validation
allAdd server-side validation to reject PHP files regardless of extension.
🧯 If You Can't Patch
- Implement web application firewall rules to block PHP file uploads
- Restrict upload directories to prevent PHP execution via .htaccess or server config
🔍 How to Verify
Check if Vulnerable:
Check Statamic version in composer.json or via 'composer show statamic/cms'Check Version:
composer show statamic/cms | grep versionsVerify Fix Applied:
Confirm version is 3.4.13+ or 4.33.0+ after update📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to form endpoints
- PHP files in upload directories with image extensions
Network Indicators:
- POST requests to form endpoints with file uploads containing PHP content
SIEM Query:
source='web_logs' AND (uri_path LIKE '%/forms/%' OR uri_path LIKE '%/submit') AND method='POST' AND content_type LIKE '%multipart/form-data%'🔗 References
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
- https://github.com/statamic/cms/commit/098ef8024d97286ca501273c18ae75b646262d75
- https://github.com/statamic/cms/commit/f6c688154f6bdbd0b67039f8f11dcd98ba061e77
- https://github.com/statamic/cms/security/advisories/GHSA-72hg-5wr5-rmfc
