GHSA-qx2q-q59v-wf3jhigh8.6

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

The advisory, in context

The fix for GHSA-7jx7-3846-m7w7 (commit 395c64f0b80b507be1c862a2ec942eaacb353748) only patched src/services/Fields.php, but the same vulnerable pattern exists in EntryTypesController::actionApplyOverrideSettings().

In src/controllers/EntryTypesController.php lines 381-387:

$settingsStr = $this->request->getBodyParam('settings');
parse_str($settingsStr, $postedSettings);
$settingsNamespace = $this->request->getRequiredBodyParam('settingsNamespace');
$settings = array_filter(ArrayHelper::getValue($postedSettings, $settingsNamespace, []));

if (!empty($settings)) {
    Craft::configure($entryType, $settings);

The $settings array from parse_str is passed directly to Craft::configure() without Component::cleanseConfig(). This allows injecting Yii2 behavior/event handlers via as or on prefixed keys, the same attack vector as the original advisory.

You need Craft control panel administrator permissions, and allowAdminChanges must be enabled for this to work.

An attacker can use the same gadget chain from the original advisory to achieve RCE.

Users should update to Craft 5.9.11 to mitigate the issue.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

craftcms/cms Packagist

Ecosystem versions

From 5.6.0 before 5.9.11

Fixed in 5.9.11

80 explicitly affected versions

5.6.0, 5.6.0.1, 5.6.0.2, 5.6.1, 5.6.10, 5.6.10.1, 5.6.10.2, 5.6.11, 5.6.12, 5.6.13, 5.6.14, 5.6.15, 5.6.16, 5.6.17, 5.6.2, 5.6.3, 5.6.4, 5.6.5, 5.6.5.1, 5.6.6, 5.6.7, 5.6.8, 5.6.9, 5.6.9.1, 5.7.0, 5.7.0-beta.1, 5.7.0-beta.2, 5.7.1, 5.7.1.1, 5.7.10, 5.7.11, 5.7.2, 5.7.3, 5.7.4, 5.7.5, 5.7.6, 5.7.7, 5.7.8, 5.7.8.1, 5.7.8.2, 5.7.9, 5.8.0, 5.8.1, 5.8.10, 5.8.11, 5.8.12, 5.8.13, 5.8.13.1, 5.8.13.2, 5.8.14, 5.8.15, 5.8.16, 5.8.17, 5.8.18, 5.8.19, 5.8.2, 5.8.20, 5.8.21, 5.8.22, 5.8.23, 5.8.3, 5.8.4, 5.8.5, 5.8.6, 5.8.7, 5.8.8, 5.8.9, 5.9.0, 5.9.0-beta.1, 5.9.0-beta.2, 5.9.1, 5.9.10, 5.9.2, 5.9.3, 5.9.4, 5.9.5, 5.9.6, 5.9.7, 5.9.8, 5.9.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "5.6.0"
        },
        {
          "fixed": "5.9.11"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "5.6.0",
    "5.6.0.1",
    "5.6.0.2",
    "5.6.1",
    "5.6.10",
    "5.6.10.1",
    "5.6.10.2",
    "5.6.11",
    "5.6.12",
    "5.6.13",
    "5.6.14",
    "5.6.15",
    "5.6.16",
    "5.6.17",
    "5.6.2",
    "5.6.3",
    "5.6.4",
    "5.6.5",
    "5.6.5.1",
    "5.6.6",
    "5.6.7",
    "5.6.8",
    "5.6.9",
    "5.6.9.1",
    "5.7.0",
    "5.7.0-beta.1",
    "5.7.0-beta.2",
    "5.7.1",
    "5.7.1.1",
    "5.7.10",
    "5.7.11",
    "5.7.2",
    "5.7.3",
    "5.7.4",
    "5.7.5",
    "5.7.6",
    "5.7.7",
    "5.7.8",
    "5.7.8.1",
    "5.7.8.2",
    "5.7.9",
    "5.8.0",
    "5.8.1",
    "5.8.10",
    "5.8.11",
    "5.8.12",
    "5.8.13",
    "5.8.13.1",
    "5.8.13.2",
    "5.8.14",
    "5.8.15",
    "5.8.16",
    "5.8.17",
    "5.8.18",
    "5.8.19",
    "5.8.2",
    "5.8.20",
    "5.8.21",
    "5.8.22",
    "5.8.23",
    "5.8.3",
    "5.8.4",
    "5.8.5",
    "5.8.6",
    "5.8.7",
    "5.8.8",
    "5.8.9",
    "5.9.0",
    "5.9.0-beta.1",
    "5.9.0-beta.2",
    "5.9.1",
    "5.9.10",
    "5.9.2",
    "5.9.3",
    "5.9.4",
    "5.9.5",
    "5.9.6",
    "5.9.7",
    "5.9.8",
    "5.9.9"
  ]
}

Set up in your agent.

Investigate in your agent.

Craft CMS vulnerable to behavior injection RCE via EntryTypesController

The advisory, in context

Affected packages

References