Authenticated Command Execution in Craft CMS Control Panel

Executive Summary

This is a high-severity remote code execution (RCE) vulnerability in Craft CMS versions 5.8.0 to 5.10.12. A remote, authenticated, non-admin user with only the accessCp permission can execute operating system commands as the PHP web worker. The flaw exists in the ElementSearchController::actionSearch() function where the criteria.with[*].when parameter from request JSON is preserved and used as a PHP callback. By setting when to system and injecting a command into the user's fullName, the attacker can execute arbitrary OS commands.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking Craft CMS versions and monitoring for suspicious activity in the Control Panel. Verify if your Craft CMS version is between 5.8.0 and 5.10.12. Check logs for unusual requests to /admin/actions/element-search/search with criteria.with[*].when parameters. Look for commands executed via the system() function in logs or unexpected file modifications.

Useful 0 Not Useful 0

Impact Analysis

Successful exploitation grants arbitrary execution of operating-system commands with the Craft PHP worker’s privileges. This allows access to application secrets, environment and database credentials, CMS content, and files readable by the PHP process. It also enables modification of content and writable application/runtime files, and disruption of the Craft service.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows remote code execution with low privileges, potentially exposing sensitive data such as application secrets, environment and database credentials, CMS content, and files readable by the PHP process. This could lead to unauthorized access to personal data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Craft CMS to version 5.10.13 or later to patch this vulnerability. Remove or restrict non-admin user access to the Control Panel until the update is applied. Review and audit all non-admin user accounts for unauthorized access or suspicious activity.

Useful 0 Not Useful 0