October is a Content Management System (CMS) and web platform to assist with development workflow. An authenticated backend user with the `editor.cms_pages`, `editor.cms_layouts`, or `editor.cms_partials` permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to `cms.safe_mode` being enabled can write specific Twig code to escape the Twig sandbox and execute arbitrary PHP. This issue has been patched in 3.4.15.
The mechanism relies on an attacker creating specially crafted Twig code that is able to bypass the Twig template engine sandbox restrictions. Although the `cms.safe_mode` mode is intended to prevent direct PHP execution by CMS editors, a properly constructed Twig payload allows breaking out of the imposed limitations and executing arbitrary PHP code in the server context. The vulnerability is classified as CWE-94, which is improper control of generation of code.
An attacker can execute arbitrary PHP code on the server, which in practice means complete takeover of the application and server control, including data theft, content modification, and potential access to other systems on the network.
October CMS should be updated to version 3.4.15 or newer, where the vulnerability has been patched. As an additional remedial measure, it is worth verifying and restricting the granting of editorial permissions to trusted users.
October CMS in versions before 3.4.15 — affects instances where users have `editor.cms_pages`, `editor.cms_layouts` or `editor.cms_partials` permissions
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HOctobercms October
APPOctobercms3.0.0 – 3.4.15 (excl.)
Related vulnerabilities
October CMS: reaktywacja wygasłej sesji po ponownym logowaniu
October CMS – manipulacja ścieżką pliku w funkcji przenoszenia zasobów
October CMS — zdalne wykonanie kodu PHP w menedżerze plików
October CMS: modyfikacja konfiguracji Apache przez niebezpieczny upload pliku
octobercms in a CMS platform based on the Laravel PHP Framework. In affected versions of the october/system pa...