Listen to this Post
The vulnerability resides in the JavaScript asset processing pipeline of Winter CMS, specifically within the `Winter\Storm\Parse\Assetic\Filter\JavascriptImporter` class. This class is invoked when the `System\Classes\CombineAssets` handler processes theme JavaScript files that are referenced in templates. The core issue is the unsafe resolution of `=include` and `=require` directives embedded inside JavaScript comment blocks. When the combiner encounters such a directive, it resolves the target file path relative to the directory of the including JavaScript asset using PHP’s `realpath()` function. Critically, there is no containment check to ensure the resolved path stays within the theme’s designated asset directory tree. This allows an attacker to use directory traversal sequences, for example =include ../../../.env, to escape the intended scope. The only imposed constraint is that the target must have a file extension, as extension-less paths automatically receive a `.js` suffix before processing. Once the directive is processed, the contents of the target file are read by the PHP process and inlined into the combined JavaScript output. This combined output is subsequently served via the public `combine/{file}` route, which lacks any authentication or authorization checks. Consequently, as soon as a template references the malicious asset, the concatenated response becomes accessible to unauthenticated visitors at a stable, predictable URL. The leaked information can include any file readable by the web server user, with the `.env` file being the most critical target as it exposes APP_KEY, database credentials, and other sensitive secrets. While text files are disclosed verbatim, binary files are corrupted by the minification process. This vulnerability is the JavaScript counterpart to previously reported issues like the LESS `@import` LFI (GHSA-58fp-mcx6-7qf9) and CVE-2023-52085, sharing the same root cause of insufficient path sanitization within asset combiner filters. Exploitation requires an authenticated backend user who possesses the `cms.manage_assets` permission, which is typically assigned to the Developer role by default. The maintainers advise restricting this permission strictly to trusted administrators.
DailyCVE Form:
Platform: Winter CMS
Version: <= v1.2.12
Vulnerability: Local File Inclusion
Severity: High
date: December 2023
Prediction: Already Patched (v1.2.13)
What Undercode Say:
Check for vulnerable directives in theme assets
grep -rnw themes/ -E ‘=include|=require’ –include=”.js”
Simulate resolution of a traversal payload
php -r “echo realpath(‘themes/demo/assets/../../../.env’);”
Identify the combine route endpoint (example)
curl -s https://target.com/combine/theme-xyz.js
View extracted content from inlined include (if accessible)
curl -s https://target.com/combine/combined-file.js | grep -o “APP_KEY.”
Exploit: (Educational Purposes!)
- Gain authenticated access to Winter CMS backend with `cms.manage_assets` permission.
- Navigate to the theme asset editor (e.g., CMS → Theme → Assets) and create or modify a `.js` file.
- Insert a malicious comment directive: `/ =include ../../../.env /` or
/ =require ../../config/app.php /. - Save the asset and ensure it is referenced by a layout, page, or partial that triggers the combine process.
- Request the combined asset URL (e.g., `/combine/path/to/asset.js` via browser or
curl). - The response will contain the contents of the targeted server file inlined within the JavaScript output, allowing extraction of secrets like `APP_KEY` and database credentials.
Protection: from this CVE
- Immediately upgrade to Winter CMS core v1.2.13 and Winter Storm v1.2.13, which include the hardened `JavascriptImporter` with two validation gates: (1) only `.js` extensions are allowed for inlining, rejecting
.env,.php,.log; (2) the resolved path must reside within the including file’s directory subtree or allowed import roots (themes, plugins, modules) viaPathResolver::withinAny(). - If immediate upgrade is not possible, manually cherry-pick commits `wintercms/storm@fd673f4` and
wintercms/winter@e09c8d3. - As a short-term workaround, revoke the `cms.manage_assets` permission from all non-administrator roles and audit existing `.js` theme files for any `=include` or `=require` directives that reference paths outside the theme’s asset directory.
Impact:
Successful exploitation allows an authenticated, low-privileged user (with asset management rights) to read arbitrary files on the server that the web process has access to. This leads to full disclosure of the application environment configuration (.env), exposing secret keys, database credentials, mailer passwords, and other sensitive parameters. The leaked data can facilitate privilege escalation, remote code execution, or lateral movement within the infrastructure. The vulnerability is publicly accessible without further authentication once the asset is combined, making it a critical information disclosure risk for any affected deployment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
