CVE-2024-58136
📋 TL;DR
This CVE describes a security regression in Yii 2 framework where improper handling of behavior attachment via __class array keys can lead to remote code execution. This affects Yii 2 applications running versions before 2.0.52. The vulnerability has been actively exploited in the wild.
💻 Affected Systems
- Yii 2 PHP Framework
📦 What is this software?
Yii by Yiiframework
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution allowing full system compromise, data exfiltration, and lateral movement within the network.
Likely Case
Remote code execution leading to web application compromise, data theft, and potential server takeover.
If Mitigated
Limited impact if proper input validation and behavior filtering are implemented at application layer.
🎯 Exploit Status
Actively exploited in the wild from February through April 2025. Exploitation requires the ability to control behavior attachment parameters.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.52
Vendor Advisory: https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52
Restart Required: No
Instructions:
1. Update Yii 2 framework to version 2.0.52 or later. 2. Update composer.json to require "yiisoft/yii2": "^2.0.52". 3. Run composer update. 4. Test application functionality.
🔧 Temporary Workarounds
Input validation for behavior parameters
allImplement strict validation and filtering of all user-controlled parameters used in behavior attachment
🧯 If You Can't Patch
- Implement WAF rules to block suspicious behavior attachment requests
- Restrict access to vulnerable endpoints using authentication and authorization controls
🔍 How to Verify
Check if Vulnerable:
Check composer.json or vendor/yiisoft/yii2/BaseYii.php version. If version is below 2.0.52, the system is vulnerable.Check Version:
php -r "echo Yii::getVersion();"Verify Fix Applied:
Verify that vendor/yiisoft/yii2/BaseYii.php contains the fix from commit 40fe496eda529fd1d933b56a1022ec32d3cd0b12📡 Detection & Monitoring
Log Indicators:
- Unusual behavior attachment requests
- Suspicious __class parameter values in logs
- Unexpected PHP execution errors
Network Indicators:
- HTTP requests with unusual behavior parameters
- POST requests containing __class keys
SIEM Query:
web_requests WHERE (url_path CONTAINS 'behavior' OR parameters CONTAINS '__class') AND suspicious_patterns🔗 References
- https://github.com/yiisoft/yii2/commit/40fe496eda529fd1d933b56a1022ec32d3cd0b12
- https://github.com/yiisoft/yii2/compare/2.0.51...2.0.52
- https://github.com/yiisoft/yii2/pull/20232
- https://github.com/yiisoft/yii2/pull/20232#issuecomment-2252459709
- https://www.yiiframework.com/news/709/please-upgrade-to-yii-2-0-52
- https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-58136
