Listen to this Post
The vulnerability exists in the access control logic for the `/marketplace/install` and `/marketplace/uninstall` endpoints. Despite a configuration setting to disable “Composer Based Updates,” these endpoints remained accessible. The application failed to validate if the requesting user had the requisite ‘marketplace:manage’ system permission before processing Composer operations. A low-privileged, authenticated user could send a crafted POST request to these endpoints with a `package` parameter. The backend would then directly execute the corresponding `composer require` or `composer remove` command on the server with the user-supplied package name. This allows the attacker to install arbitrary, potentially malicious PHP packages from public repositories like Packagist, leading to remote code execution and full system compromise.
Platform: Mautic
Version: 4.0.0-4.4.17
Vulnerability: Privilege Escalation
Severity: Critical
date: 2025-12-02
Prediction: 2025-12-09
What Undercode Say:
curl -X POST 'http://<target>/marketplace/install' -H 'Authorization: Bearer <user_token>' --data 'package="malicious/package"'
// Example backend code flaw
if (!$config->get('composer_updates_enabled')) { / UI hidden / }
// Missing permission check: $security->isGranted('marketplace:manage')
$package = $request->request->get('package');
shell_exec("composer require {$package}");
How Exploit:
Authenticated low-privilege request.
Bypasses Marketplace GUI restriction.
Triggers arbitrary composer command.
Protection from this CVE:
Update to patched versions.
Enforce ‘marketplace:manage’ permission.
Sanitize package name inputs.
Impact:
Remote Code Execution.
Full System Compromise.
Privilege Escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
