craftcms/cms: Authenticated admin RCE via Content Block field-layout JSON-string cleanse

This requires allowAdminChanges to be enabled, which is against security recommendations.

craft\fields\ContentBlock::setFieldLayout() accepts a string field-layout config, JSON-decodes it after the Component::cleanseConfig() sanitization boundary, and passes the result to Fields::createLayout(), which calls Craft::createObject() with no re-cleanse. A surviving top-level as X / on X key (a Yii behavior/event gadget) is therefore honored during object hydration, attaching an attacker-controlled behavior/event handler to the FieldLayout — the same terminal gadget abused by GHSA-265m-7826-wjqm — yielding authenticated admin remote code execution as the web user.

This is a distinct, unpatched caller of the object-config → behavior-injection RCE family.

Craft has patched this family caller-by-caller (Conditions::createCondition, assembleLayoutFromPost for GHSA-7jx7-3846-m7w7; ElementIndexesController for GHSA-2fph-6v5w-89hh; element-index/search for GHSA-qrgm-p9w5-rrfw) and never converted createLayout() to cleanse internally, leaving ContentBlock::setFieldLayout untouched.

Impact

Authenticated admin (with allowAdminChanges = true, the default) achieves OS command execution as the web/PHP user, plus secret/environment disclosure — identical terminal impact to GHSA-265m-7826-wjqm and GHSA-7jx7-3846-m7w7.

Report ID: 1716