GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-g6v3-wv4j-x9hgmedium4.9

October Rain has Environment Variable Exfiltration via INI Parser Interpolation

Impact

A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.

Source excerpt · OSV
Applies when

Impact

  • Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
  • Could enable further attacks: database access, cookie forgery, AWS resource access
  • Requires authenticated backend access with Editor permissions
  • Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

october/rain Packagist
Affected rangeRecorded fix
From 4.0.0 before 4.1.10Ecosystem versions4.1.10
Earlier releases before 3.7.14Ecosystem versions3.7.14

Version evidence: OSV · GHSA-g6v3-wv4j-x9hg

View original version evidence (362 explicit versions)

Original source description

A server-side information disclosure vulnerability was identified in the INI settings parser. PHP's parse_ini_string() function supports ${} syntax for environment variable interpolation. Attackers with Editor access could inject ${APP_KEY}, ${DB_PASSWORD}, or similar patterns into CMS page settings fields, causing sensitive environment variables to be resolved and stored in the template. These values were then returned to the attacker when the page was reopened.

Impact

  • Exfiltration of sensitive environment variables (APP_KEY, DB credentials, AWS keys, etc.)
  • Could enable further attacks: database access, cookie forgery, AWS resource access
  • Requires authenticated backend access with Editor permissions
  • Only relevant when cms.safe_mode is enabled (otherwise direct PHP injection is already possible)

Patches

The vulnerability has been patched in v3.7.14 and v4.1.10. All users are encouraged to upgrade to the latest patched version.

Workarounds

If upgrading immediately is not possible:

  • Restrict Editor tool access to fully trusted administrators only
  • Ensure database and cloud service credentials are not accessible from the web server's network

References

  • Reported by Pentest-Tools.com

References