Remote Code Execution in Craft CMS via Twig Group Filter

Executive Summary

This is a remote code execution (RCE) vulnerability in Craft CMS versions 4.x before 4.18.8 and 5.x before 5.11.0. It occurs in the Twig group filter where authenticated Control Panel users can pass an array-callable like FileHelper::writeToFile as an arrow argument. This bypasses validation and allows writing a webshell to the webroot, enabling code execution as the web user.

Useful 0 Not Useful 0

Detection Guidance

Check Craft CMS version with command: composer show craftcms/cms. If version is 4.0.0-4.18.7 or 5.0.0-5.10.9, it is vulnerable. Inspect Twig group filter usage in templates for array-callable patterns like ['craft\helpers\FileHelper','writeToFile'}. Monitor webroot for unexpected files and check logs for suspicious Control Panel activity.

Useful 0 Not Useful 0

Impact Analysis

An attacker with Control Panel access could exploit this to write and execute malicious code on your server. This could lead to full system compromise, data theft, or further network infiltration. The impact depends on server permissions but could be severe.

Useful 0 Not Useful 0

Compliance Impact

This RCE vulnerability could lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements. Non-compliance risks include fines, legal action, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Craft CMS to version 4.18.8 or 5.11.0 or later immediately. Disable enableTwigSandbox if enabled. Review and restrict Control Panel user permissions, especially for lower-privilege editors. Remove any unauthorized files in the webroot and audit recent file modifications.

Useful 0 Not Useful 0