CVE-2024-52291 Local File System Validation Bypass Leading to File Overwrite, Sensitive File Access, and Potential Code Execution
Authenticated administrators can bypass file system validation to overwrite files, access sensitive data, or execute code via SSTI in Craft CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-52291?
CVE-2024-52291 is a high-severity path traversal vulnerability in Craftcms Craft Cms, published on 13 Nov 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Craft is a content management system (CMS). A vulnerability in CraftCMS allows an attacker to bypass local file system validation by utilizing a double file:// scheme (e.g., file://file:////). This enables the attacker to specify sensitive folders as the file system, leading to potential file overwriting through malicious uploads, unauthorized access to sensitive files, and, under certain conditions, remote code execution (RCE) via Server-Side Template Injection (SSTI) payloads. Note that this will only work if you have an authenticated administrator account with allowAdminChanges enabled. This is fixed in 5.4.6 and 4.12.5.
Weakness: CWE-22
Which versions are affected by CVE-2024-52291?
4 open source packages ship an affected version, including craftcms/cms. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
craftcms/cms Packagist | From 4.0.0-RC1 | 4.12.5 |
craftcms/cms Packagist | From 4.0.0-RC1 | 4.12.5 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.4.6 |
craftcms/cms Packagist | From 5.0.0-RC1 | 5.4.6 |
Products include Craftcms Craft Cms.
How do I fix CVE-2024-52291?
Upgrade craftcms/cms to a fixed version for your release line: 4.12.5 or 5.4.6.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-52291 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-52291 exists.
Other vulnerabilities in Craftcms Craft Cms
Sources
Also known as GHSA-jrh5-vhr9-qh7q.