Summary
Certain WoltLab products contain a cache-poisoning vulnerability that lets an authenticated, low-privileged user inject PHP code into executable cache files. If attacker-controlled data is processed into a cache file and can terminate a nowdoc block, the resulting code may execute in the application environment.
Affected context
The vulnerability occurs in WoltLab Suite Core deployments using affected WCF releases where generated cache files are executable PHP and incorporate attacker-controlled data. Exploitation depends on the application processing that data into a cache artifact without sufficiently preserving the generated file's code structure.
Exploit preconditions
- Attack surface: WoltLab Suite application functionality that contributes data
to generated cache files
- Required access: An authenticated account with low privileges that can submit
or modify data reaching the affected cache-generation path
- Trigger point: Cache creation, regeneration, or subsequent loading by the
application
- Why exploitation is possible: Attacker-controlled content can terminate a
nowdoc section and introduce PHP statements into an executable cache file
Why this happens
The underlying bug is an unsafe code-generation pattern in which data is placed into PHP cache files without reliably preventing it from escaping its intended literal context. A nowdoc delimiter can be prematurely terminated when embedded content is not safely handled, causing data to become executable PHP rather than inert cache content. This behavior maps to CWE-94, Improper Control of the Generation of Code.
Potential impact
- An attacker may execute arbitrary PHP code in the application process.
- The application and its data could be compromised.
- Sensitive information may be disclosed or altered.
- Server-side persistence or lateral movement could become possible.
- Application availability could be affected.
General mitigation guidance
Mitigation generally focuses on preventing untrusted values from entering executable cache templates and separating data from code. Common defensive patterns include using structured, non-executable cache formats; applying context-appropriate encoding or escaping before values are embedded; validating cache inputs against strict schemas; protecting cache directories from untrusted writes; invalidating and regenerating potentially poisoned artifacts; and running the application with least privilege. Secure-by-default designs should treat generated cache content as data rather than executable source whenever possible.
How teams detect issues like this
Detection may include static analysis for dynamic PHP source generation, interpolation of user-controlled values into nowdoc or heredoc blocks, and writes to executable cache locations. Code reviews can look for cache templates that mix trusted syntax with insufficiently constrained application data. Runtime monitoring can alert on unexpected changes to cache files, PHP constructs appearing in data fields, or anomalous application-process behavior. CI policies and automated code-review tools can flag risky code-generation and cache-writing patterns.
