Summary
Craft CMS contains a code injection vulnerability in its Twig sandbox that can affect authenticated Control Panel users. By supplying uncleansed criteria to certain element-query methods, an attacker may attach malicious event handlers and execute code as the web user when the query runs.
Craft CMS contains a code injection vulnerability in its Twig sandbox that can affect authenticated Control Panel users. By supplying uncleansed criteria to certain element-query methods, an attacker may attach malicious event handlers and execute code as the web user when the query runs.
Affected context
The vulnerability occurs in Craft CMS deployments where authenticated Control Panel users can invoke the affected element-query functionality and provide criteria that are insufficiently constrained. Risk is higher when those users have access to features that process Twig expressions or query configuration, and when the web-process account has broad permissions.
The vulnerability occurs in Craft CMS deployments where authenticated Control Panel users can invoke the affected element-query functionality and provide criteria that are insufficiently constrained. Risk is higher when those users have access to features that process Twig expressions or query configuration, and when the web-process account has broad permissions.
Exploit preconditions
- Attack surface: Craft CMS Control Panel element-query functionality
- Required access: An authenticated Control Panel account with access to the affected functionality
- Trigger point: Execution of a query through
getNext,getPrev, orgetOwners - Why exploitation is possible: User-controlled criteria can introduce Yii configuration behavior that attaches event handlers during query processing, allowing attacker-controlled code to execute within the application context
- Attack surface: Craft CMS Control Panel element-query functionality
- Required access: An authenticated Control Panel account with access to the affected functionality
- Trigger point: Execution of a query through
getNext,getPrev, orgetOwners - Why exploitation is possible: User-controlled criteria can introduce Yii configuration behavior that attaches event handlers during query processing, allowing attacker-controlled code to execute within the application context
Why this happens
The underlying issue is inadequate sanitization and constraint enforcement for criteria passed into element-query methods operating within the Twig sandbox. Although the sandbox is intended to limit dangerous template behavior, attacker-controlled configuration keys can influence Yii object behavior and event registration during query execution. This represents CWE-94: Improper Control of Generation of Code, because untrusted input can affect executable application behavior rather than remaining limited to data filtering.
The underlying issue is inadequate sanitization and constraint enforcement for criteria passed into element-query methods operating within the Twig sandbox. Although the sandbox is intended to limit dangerous template behavior, attacker-controlled configuration keys can influence Yii object behavior and event registration during query execution. This represents CWE-94: Improper Control of Generation of Code, because untrusted input can affect executable application behavior rather than remaining limited to data filtering.
Potential impact
- An attacker may execute arbitrary code as the web-server user
- Application secrets, configuration data, or stored content could be exposed
- The attacker could modify CMS content or application files
- The compromise could enable persistence or further activity within the hosting environment
- Data integrity and availability may be affected
- An attacker may execute arbitrary code as the web-server user
- Application secrets, configuration data, or stored content could be exposed
- The attacker could modify CMS content or application files
- The compromise could enable persistence or further activity within the hosting environment
- Data integrity and availability may be affected
General mitigation guidance
Mitigation generally focuses on reducing the ability of user-controlled query criteria to influence executable framework behavior.
Common defensive patterns include:
- Restricting element-query criteria to an explicit allowlist of supported fields and values
- Removing or neutralizing configuration keys that can register callbacks or event handlers
- Enforcing server-side validation after template or request processing, before query execution
- Maintaining strict separation between data filters and framework configuration
- Applying least privilege to Control Panel roles and the web-process account
- Limiting filesystem, process, and secret access available to the CMS runtime
- Treating authenticated users and stored CMS content as potentially untrusted input
Mitigation generally focuses on reducing the ability of user-controlled query criteria to influence executable framework behavior.
Common defensive patterns include:
- Restricting element-query criteria to an explicit allowlist of supported fields and values
- Removing or neutralizing configuration keys that can register callbacks or event handlers
- Enforcing server-side validation after template or request processing, before query execution
- Maintaining strict separation between data filters and framework configuration
- Applying least privilege to Control Panel roles and the web-process account
- Limiting filesystem, process, and secret access available to the CMS runtime
- Treating authenticated users and stored CMS content as potentially untrusted input
How teams detect issues like this
Detection approaches may include:
- Static analysis rules for dynamic criteria passed into
getNext,getPrev, andgetOwners - Code review checks for user-controlled Yii configuration keys such as event or callback-related settings
- Monitoring application logs for unusual element-query criteria, repeated query failures, or unexpected Control Panel activity
- Reviewing web-process behavior for unexpected child processes, file modifications, or outbound connections
- Enforcing policy checks that require allowlisted query parameters and prohibit dynamic event registration from request-derived data
- Using automated application security testing to evaluate sandbox boundaries and query input handling
Detection approaches may include:
- Static analysis rules for dynamic criteria passed into
getNext,getPrev, andgetOwners - Code review checks for user-controlled Yii configuration keys such as event or callback-related settings
- Monitoring application logs for unusual element-query criteria, repeated query failures, or unexpected Control Panel activity
- Reviewing web-process behavior for unexpected child processes, file modifications, or outbound connections
- Enforcing policy checks that require allowlisted query parameters and prohibit dynamic event registration from request-derived data
- Using automated application security testing to evaluate sandbox boundaries and query input handling
