craftcms/cms: Authenticated RCE via Twig group filter array-callable
What fixes it
- 4.18.8craftcms/cms, composerGitHub
composer require "craftcms/cms:^4.18.8" - 5.11.0craftcms/cms, composerGitHub
composer require "craftcms/cms:^5.11.0"
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Twig group filter’s arrow argument is invoked without the checkArrow guard that every other arrow-accepting filter has. groupFilter(iterable $arr, callable|string $arrow) takes the non-string branch $groupKey = (string)$arrow($item, $key) for any non-string $arrow. A Twig array literal such as ['craft\helpers\FileHelper','writeToFile'] is a valid PHP array-callable, is not a string, and is invoked with two attacker-controlled arguments — arbitrary static/instance method invocation. When combined with FileHelper::writeToFile, this writes an attacker-controlled webshell to the webroot, an authenticated RCE requiring no gadget.
Reachability gate (identical to published advisory GHSA-f5wm-88jv-g5hx): enableTwigSandbox=true (default false) plus authenticated Control Panel access, via B2 element-select condition rules (BaseElementSelectConditionRule.php:130, reachable by lower-privilege control panel editors).
Impact
An authenticated control panel user can achieve a remote code execution as the web user, no gadget required.
Report ID: 1720
Text from GitHub Advisory Database
Affected versions 2
- craftcms/cms, composer>= 4.0.0, <= 4.18.8GitHub
- craftcms/cms, composer>= 5.0.0, < 5.11.0GitHub