craftcms/cms: Authenticated RCE via render-components Entry Type overrides

Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.

Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().

This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.

The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.

Prerequisites

1. Give the user Control Panel access.
2. Ensure at least one entry type and one entry exist. They do not need to correspond because typeId is overridden in memory.
3. Sign in as the limited user and record:
4. the authenticated session/Cookie header;
5. the raw csrfTokenValue returned by Craft for that session;
6. the numeric ID of an existing entry type;
7. the numeric element ID of an existing entry.

Impact

This is an authenticated OS command execution vulnerability. A malicious or compromised low-privileged Control Panel account can cross from application-level access to code execution as the PHP/web-server service account.

Depending on that operating-system account’s permissions, exploitation may allow the attacker to:

• read Craft security keys, database credentials, and environment configuration available to PHP;
• read or modify site content and user data;
• modify application files writable by the web-server account and establish persistence;
• access internal services reachable from the Craft host; or
• disrupt availability.

The exploit does not require allowAdminChanges, project-config modification, Kubernetes object access, environment-variable control, prior filesystem access, root privileges, poison injection from another system, or exploitation of an upstream dependency vulnerability.

Report ID: 1684