Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action\u00a0app\/render-components.<\/p>\n
Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an\u00a0EntryType\u00a0object\u2019s\u00a0uiLabelFormat\u00a0and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by\u00a0renderObjectTemplate().<\/p>\n
This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as\u00a0system(), resulting in operating-system command execution with the privileges of the PHP\/web-server process.<\/p>\n
The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.<\/p>\n","protected":false},"excerpt":{"rendered":"
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action\u00a0app\/render-components.<\/p>\n
Any authenticated user with basic Control Panel access can submi<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33445","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33445","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33445"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33445"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33445"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}