Unauthorized Asset Deletion in Craft CMS

Executive Summary

This vulnerability exists in Craft CMS versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14. It occurs because the AssetsController::actionDeleteFolder() method only requires the deleteAssets:<volume-uid> permission to delete a folder, but does not enforce the deletePeerAssets:<volume-uid> permission. As a result, when a folder is deleted, all descendant folders and assets inside are also deleted without checking if the user has permission to delete peer assets uploaded by other users.

This means a low-privilege user who has folder-management rights on a shared volume can delete assets uploaded by other users, bypassing the intended per-asset peer-permission checks that are correctly applied in other parts of the system.

The issue was fixed in versions 4.17.15 and 5.9.22.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves a missing peer-permission check in Craft CMS's AssetsController::actionDeleteFolder function, allowing users with folder-management rights to delete assets uploaded by other users without proper authorization.

To detect if your system is vulnerable, first verify the Craft CMS version. Versions from 4.0.0-RC1 through 4.17.14 and 5.0.0-RC1 through 5.9.21 are affected.

You can check the installed Craft CMS version by running a command on the server hosting the CMS, for example:

• grep 'version' path/to/craftcms/composer.json
• or check the version via the CMS control panel if accessible.

To detect exploitation attempts or unauthorized deletions, monitor logs for calls to the actionDeleteFolder endpoint, especially those initiated by low-privilege users with folder-management rights.

If you have access to the web server logs, you can search for requests to the delete folder API endpoint, for example:

• grep 'actionDeleteFolder' /path/to/webserver/access.log

Additionally, review audit logs or database records for unexpected deletions of assets or folders by users who should not have peer asset deletion permissions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a low-privilege user with folder-management rights to delete assets uploaded by other users on a shared volume. This can lead to unauthorized destruction of important content, data loss, and disruption of operations that rely on those assets.

Because the deletion cascades to all descendant folders and assets, the impact can be significant, potentially affecting large amounts of data.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows low-privilege users with folder-management rights on a shared volume to delete assets uploaded by other users without proper authorization. This unauthorized deletion can impact the integrity and availability of data stored within the system.

Such unauthorized data deletion could potentially conflict with compliance requirements under standards like GDPR and HIPAA, which mandate strict controls over data integrity, availability, and access permissions to protect personal and sensitive information.

However, the vulnerability does not lead to information disclosure or remote code execution, so the risk is primarily related to data integrity and availability rather than confidentiality.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Craft CMS to version 4.17.15 or later, or version 5.9.22 or later, where the issue has been fixed.

Useful 0 Not Useful 0