Craft CMS Vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Vulnerability Details

Attack Prerequisites

• Authentication: Admin-level access required
• Network Access: Access to admin panel (/admin)

Location

• File: src/services/Fields.php
• Function: assembleLayoutFromPost() (lines 1125-1143)
• Root Cause: Missing cleanseConfig() call on user-supplied fieldLayout POST parameter

Vulnerable Code Path

// src/services/Fields.php:1125-1133
public function assembleLayoutFromPost(?string $namespace = null): FieldLayout
{
    $paramPrefix = $namespace ? rtrim($namespace, '.') . '.' : '';
    $request = Craft::$app->getRequest();
    $config = JsonHelper::decode($request->getBodyParam("{$paramPrefix}fieldLayout"));
    // ... additional config values added ...
    $layout = $this->createLayout($config);  // <-- No cleanseConfig() call!
    // ...
}

// src/services/Fields.php:1089-1093
public function createLayout(array $config): FieldLayout
{
    $config['class'] = FieldLayout::class;
    return Craft::createObject($config);  // <-- Untrusted data passed directly
}

Attack Chain

The exploitation leverages Yii2's object configuration system and behavior attachment mechanism:

1. Behavior Injection: Attacker includes 'as rce' key in the fieldLayout JSON POST parameter
2. Object Creation: Craft::createObject() processes the config through Yii2's BaseYii::configure()
3. Behavior Attachment: Yii2's Component::__set() detects the 'as ' prefix and attaches the behavior
4. RCE Trigger: When validate() is called on the model, EVENT_AFTER_VALIDATE fires
5. Command Execution: AttributeTypecastBehavior calls the configured typecast function (ConsoleProcessus::execute) with the uid attribute value as the command

RCE Gadget Chain

FieldLayout POST parameter
    → Craft::createObject()
    → Yii2 Component::__set() with 'as rce' key
    → AttributeTypecastBehavior attached
    → Model::validate() called
    → EVENT_AFTER_VALIDATE triggered
    → typecastAfterValidate → typecastAttributes()
    → call_user_func(['Psy\Readline\Hoa\ConsoleProcessus', 'execute'], $command)
    → Shell command execution

Affected Controllers

The assembleLayoutFromPost() function is called by multiple admin controllers:

References

• https://github.com/craftcms/cms/commit/395c64f0b80b507be1c862a2ec942eaacb353748
• GHSA-255j-qw47-wjh5 - Previously patched RCE vulnerability via behavior injection (affecting different endpoints)
• CVE-2024-4990 - Related vulnerability that inspired the behavior injection attack pattern
• Yii2 GHSA-gcmh-9pjj-7fp4 - Original Yii framework report (framework team declined to fix at framework level)