Summary
Craft CMS contains a code injection vulnerability in field layout processing that allows authenticated administrators to inject Yii behaviors through a crafted JSON field layout.
When administrative changes are enabled, a malicious administrator may execute operating system commands as the web server user and access application secrets.
Craft CMS contains a code injection vulnerability in field layout processing that allows authenticated administrators to inject Yii behaviors through a crafted JSON field layout.
When administrative changes are enabled, a malicious administrator may execute operating system commands as the web server user and access application secrets.
Affected context
The vulnerability occurs in Craft CMS versions that process administrator-controlled JSON field layouts through ContentBlock::setFieldLayout(). It becomes risky when allowAdminChanges is enabled and an authenticated administrator can submit layouts containing behavior-related keys that are not adequately removed during configuration cleansing.
The vulnerability occurs in Craft CMS versions that process administrator-controlled JSON field layouts through ContentBlock::setFieldLayout(). It becomes risky when allowAdminChanges is enabled and an authenticated administrator can submit layouts containing behavior-related keys that are not adequately removed during configuration cleansing.
Exploit preconditions
- Attack surface: Craft CMS administrative field layout management
- Required access: Authenticated administrator privileges or equivalent permission to modify field layouts
- Deployment condition:
allowAdminChangesmust be enabled - Trigger point: Processing a supplied JSON string field layout through
ContentBlock::setFieldLayout() - Why exploitation is possible: Certain
as Xoron Xkeys can bypass configuration cleansing and cause attacker-controlled Yii behaviors to be interpreted as executable configuration
- Attack surface: Craft CMS administrative field layout management
- Required access: Authenticated administrator privileges or equivalent permission to modify field layouts
- Deployment condition:
allowAdminChangesmust be enabled - Trigger point: Processing a supplied JSON string field layout through
ContentBlock::setFieldLayout() - Why exploitation is possible: Certain
as Xoron Xkeys can bypass configuration cleansing and cause attacker-controlled Yii behaviors to be interpreted as executable configuration
Why this happens
The underlying issue is insufficiently constrained processing of administrator-supplied configuration data. Although cleanseConfig() is intended to remove unsafe behavior definitions, specially named behavior keys can bypass that cleansing step and reach Yii's behavior-resolution mechanisms.
This maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because attacker-controlled configuration is interpreted in a way that can trigger executable behavior and operating system command execution.
The underlying issue is insufficiently constrained processing of administrator-supplied configuration data. Although cleanseConfig() is intended to remove unsafe behavior definitions, specially named behavior keys can bypass that cleansing step and reach Yii's behavior-resolution mechanisms.
This maps to CWE-94: Improper Control of Generation of Code ('Code Injection'), because attacker-controlled configuration is interpreted in a way that can trigger executable behavior and operating system command execution.
Potential impact
- An attacker may execute commands with the privileges of the web server process.
- Application secrets, credentials, or environment data could be disclosed.
- Website content and administrative configuration could be modified.
- The compromised application could be used to access connected services or internal systems.
- Data integrity and platform availability could be affected.
- An attacker may execute commands with the privileges of the web server process.
- Application secrets, credentials, or environment data could be disclosed.
- Website content and administrative configuration could be modified.
- The compromised application could be used to access connected services or internal systems.
- Data integrity and platform availability could be affected.
General mitigation guidance
Mitigation generally focuses on preventing user-controlled field layout data from reaching executable behavior mechanisms.
Common defensive patterns include:
- Restricting field layout input to an explicit schema and allowlisted keys.
- Rejecting behavior declarations and other executable configuration constructs in user-supplied JSON.
- Applying validation before any framework behavior resolution or object configuration occurs.
- Disabling administrative configuration changes when they are not required.
- Separating content administration from system configuration privileges.
- Running the web process with least privilege and limiting access to secrets and sensitive operating-system resources.
- Reducing trust in administrative input through approval workflows, audit logging, and change monitoring.
Mitigation generally focuses on preventing user-controlled field layout data from reaching executable behavior mechanisms.
Common defensive patterns include:
- Restricting field layout input to an explicit schema and allowlisted keys.
- Rejecting behavior declarations and other executable configuration constructs in user-supplied JSON.
- Applying validation before any framework behavior resolution or object configuration occurs.
- Disabling administrative configuration changes when they are not required.
- Separating content administration from system configuration privileges.
- Running the web process with least privilege and limiting access to secrets and sensitive operating-system resources.
- Reducing trust in administrative input through approval workflows, audit logging, and change monitoring.
How teams detect issues like this
Detection can include static analysis and code review for paths where JSON or form input is passed into framework configuration, behavior attachment, object construction, or command-related APIs.
Useful signals include:
- Calls to field layout setters that accept raw serialized input.
- Cleansing routines that rely on denylisting special keys.
- Administrative endpoints that permit dynamic behavior or event configuration.
- Runtime requests containing unexpected
asoronconfiguration keys. - Web-process child-process creation, unusual command execution, or access to environment and secret files after administrative changes.
Automated security scanning and policy checks can help flag executable configuration flows during pull requests and deployment validation.
Detection can include static analysis and code review for paths where JSON or form input is passed into framework configuration, behavior attachment, object construction, or command-related APIs.
Useful signals include:
- Calls to field layout setters that accept raw serialized input.
- Cleansing routines that rely on denylisting special keys.
- Administrative endpoints that permit dynamic behavior or event configuration.
- Runtime requests containing unexpected
asoronconfiguration keys. - Web-process child-process creation, unusual command execution, or access to environment and secret files after administrative changes.
Automated security scanning and policy checks can help flag executable configuration flows during pull requests and deployment validation.
