Summary
Craft CMS contains a code injection vulnerability in the Twig group filter that can invoke attacker-influenced callable arguments without applying the expected safety check. An authenticated control panel user who can configure element-selection condition rules may write a webshell to the webroot and execute code with the web server's privileges.
Craft CMS contains a code injection vulnerability in the Twig group filter that can invoke attacker-influenced callable arguments without applying the expected safety check. An authenticated control panel user who can configure element-selection condition rules may write a webshell to the webroot and execute code with the web server's privileges.
Affected context
The vulnerability affects Craft CMS 4.x releases before 4.18.8 and 5.x releases before 5.11.0 when the Twig group filter processes non-string arrow arguments. It becomes risky in deployments where authenticated control panel users can create or modify element-select condition rules and the webroot is writable by the application process.
The vulnerability affects Craft CMS 4.x releases before 4.18.8 and 5.x releases before 5.11.0 when the Twig group filter processes non-string arrow arguments. It becomes risky in deployments where authenticated control panel users can create or modify element-select condition rules and the webroot is writable by the application process.
Exploit preconditions
- Attack surface: Craft CMS control panel functionality that processes Twig group-filter expressions
- Required access: An authenticated control panel account with permission to influence element-select condition rules
- Trigger point: Evaluation of a Twig group filter containing a non-string arrow argument
- Why exploitation is possible: The filter invokes the argument as a callable without the validation guard used by other arrow-accepting filters, allowing attacker-controlled callable behavior to reach file-writing functionality
- Attack surface: Craft CMS control panel functionality that processes Twig group-filter expressions
- Required access: An authenticated control panel account with permission to influence element-select condition rules
- Trigger point: Evaluation of a Twig group filter containing a non-string arrow argument
- Why exploitation is possible: The filter invokes the argument as a callable without the validation guard used by other arrow-accepting filters, allowing attacker-controlled callable behavior to reach file-writing functionality
Why this happens
The underlying bug is inconsistent validation of callable arguments in the Twig filter implementation. The group filter accepts non-string arrow values and invokes them without applying the checkArrow guard used by comparable filters, allowing an array-style callable to reach sensitive operations. This maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced template processing can cause unintended code execution rather than remaining limited to safe data transformation.
The underlying bug is inconsistent validation of callable arguments in the Twig filter implementation. The group filter accepts non-string arrow values and invokes them without applying the checkArrow guard used by comparable filters, allowing an array-style callable to reach sensitive operations. This maps to CWE-94: Improper Control of Generation of Code, because attacker-influenced template processing can cause unintended code execution rather than remaining limited to safe data transformation.
Potential impact
- An attacker may write a webshell or other executable content to the webroot
- The application may execute attacker-controlled code as the web server user
- Sensitive application data and configuration could be accessed or modified
- The Craft CMS installation could be used for persistence, defacement, or further compromise
- Connected systems may be exposed if the application account has excessive privileges
- An attacker may write a webshell or other executable content to the webroot
- The application may execute attacker-controlled code as the web server user
- Sensitive application data and configuration could be accessed or modified
- The Craft CMS installation could be used for persistence, defacement, or further compromise
- Connected systems may be exposed if the application account has excessive privileges
General mitigation guidance
Mitigation generally focuses on ensuring that every Twig filter accepting arrow or callable arguments applies consistent validation before invocation.
Common defensive patterns include:
- Restricting arrow arguments to approved, non-callable data transformations
- Applying centralized callable validation and allowlisting across all relevant filters
- Preventing template expressions from reaching file-system or process-execution APIs
- Limiting control panel permissions for users who can define element-selection conditions
- Running the application with least-privilege file-system and database permissions
- Preventing the web user from writing executable files to the webroot where practical
- Separating uploaded or generated content from executable application paths
Mitigation generally focuses on ensuring that every Twig filter accepting arrow or callable arguments applies consistent validation before invocation.
Common defensive patterns include:
- Restricting arrow arguments to approved, non-callable data transformations
- Applying centralized callable validation and allowlisting across all relevant filters
- Preventing template expressions from reaching file-system or process-execution APIs
- Limiting control panel permissions for users who can define element-selection conditions
- Running the application with least-privilege file-system and database permissions
- Preventing the web user from writing executable files to the webroot where practical
- Separating uploaded or generated content from executable application paths
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that identify dynamic callable invocation in template filters
- Code review checks for inconsistent validation between related arrow-accepting functions
- Searches for filter implementations that invoke user-influenced values without allowlisting
- Monitoring control panel audit logs for unusual element-select condition changes
- File-integrity monitoring for newly created or modified executable files in the webroot
- Web-server and application logs showing unexpected requests to recently created files
Automated security review tools may help identify dynamic invocation and unsafe template-to-application control-flow patterns.
Organizations can look for this class of issue through:
- Static analysis rules that identify dynamic callable invocation in template filters
- Code review checks for inconsistent validation between related arrow-accepting functions
- Searches for filter implementations that invoke user-influenced values without allowlisting
- Monitoring control panel audit logs for unusual element-select condition changes
- File-integrity monitoring for newly created or modified executable files in the webroot
- Web-server and application logs showing unexpected requests to recently created files
Automated security review tools may help identify dynamic invocation and unsafe template-to-application control-flow patterns.
