CVE-2023-47129

Executive Summary

CVE-2023-47129 is a remote code execution (RCE) vulnerability in Statamic CMS, a Laravel-based content management system distributed as a Composer package. Versions prior to 3.4.13 and 4.33.0 are affected. The flaw allows authenticated or unauthenticated attackers (depending on form configuration) to upload PHP files disguised as image files through front-end "Forms" feature asset upload fields, potentially leading to arbitrary code execution on the underlying web server. The vulnerability carries a CVSS score of 8.4 (High) and does not affect the control panel — it is exclusively exploitable through publicly accessible forms that include an asset upload field. Organizations running Statamic with exposed front-end forms should treat this as a critical risk even though no in-the-wild exploitation has been confirmed to date.

Technical Analysis

The vulnerability resides in the file upload validation logic of Statamic CMS's "Forms" feature — a built-in capability that allows site administrators to create and publish front-end forms (contact forms, submission forms, application forms, etc.) that may include an asset upload field. The flaw is a classic unrestricted file upload issue (CWE-434).

Vulnerability mechanism:

When a user submits a front-end form containing an asset upload field, Statamic's asset management pipeline processes the uploaded file to determine its type. The validation logic fails to sufficiently verify that the file's true content matches its claimed image type. An attacker can craft a PHP file with:

1. Image-like file extension (e.g., .jpg, .png, .gif) to pass extension-based checks.
2. A valid image header/magic bytes at the beginning of the file to bypass content-sniffing heuristics.
3. Embedded PHP code appended after the image header.

When the server later serves this file (e.g., via the asset URL), the web server's handler processes the PHP code, resulting in arbitrary code execution with the privileges of the web server user.

Attack surface specifics from the CNA description:

• Scope limitation: Only forms created using Statamic's "Forms" feature are affected. Arbitrary HTML forms or custom forms outside this feature are not vulnerable.
• Control panel exclusion: The vulnerability does not affect the authenticated control panel — the flaw is strictly in the front-end form handling path.
• Upload location: Uploaded files are stored as assets, meaning the web server must be configured to execute PHP within the asset storage directory for full RCE impact.

Root cause analysis (class-level):

The issue stems from insufficient validation of file content type at upload time. The validation likely relies on MIME type detection that can be spoofed by prepending valid image magic bytes to a malicious PHP payload. This is a well-known weakness in PHP-based CMS platforms where getimagesize(), finfo_file(), or similar functions can be bypassed with polyglot files.

Exploitation Scenarios

No public PoC or exploit code is currently available. The following attack chain is inferred from the vulnerability class (unrestricted file upload) and the specific details provided in the NVD description.

Step 1 — Reconnaissance / Target Identification: An attacker identifies Statamic CMS installations by fingerprinting the platform. Statamic sites typically share distinctive characteristics: the /-/ asset URL pattern (e.g., https://target.com/assets/), unique meta tags, or the "Statamic" string in page source or HTTP response headers. Shodan search queries such as http.html:"statamic" or http.title:"Statamic" can aggregate candidate targets. The attacker then probes for publicly accessible forms. Statamic forms are typically exposed via URLs like /forms/*, /contact, or custom routes the site administrator has defined. The attacker needs to locate a form that includes an asset upload field (e.g., file attachment, image submission).

Step 2 — Triggering the Flaw: The attacker crafts a PHP webshell payload embedded within an image file. Common techniques include:

• Appending <?php system($_GET['cmd']); ?> to a valid JPEG/PNG/GIF file (a "polyglot" file).
• Ensuring the file begins with valid image magic bytes (e.g., \xFF\xD8\xFF\xE0 for JPEG, \x89PNG\r\n\x1a\n for PNG).
• Naming the file with a double extension (e.g., shell.php.jpg) or a null-byte injection if the backend improperly handles filenames.

The attacker submits the form with the crafted file in the asset upload field. Because the front-end form bypasses the control panel's stricter validation, the file is accepted as an image and stored in the asset directory.

Step 3 — Payload Execution: Once uploaded, the attacker needs to trigger execution. Depending on server configuration:

• If the web server (Apache/mod_php, Nginx/php-fpm) executes PHP within the asset directory, the attacker accesses the file URL directly (e.g., https://target.com/assets/shell.php.jpg). If the server is misconfigured to treat .jpg files as PHP (common in misconfigured Apache with AddType directives), direct access executes the payload.
• If the asset storage respects file extensions, the attacker may need to use a filename like shell.php with an image content-type header that passes validation. Careful crafting of the upload content can sometimes cause the stored file to retain a .php extension if the validation only inspects the first few bytes.

Step 4 — Post-Exploitation Impact: Successful code execution grants the attacker:

• Full control of the web application and the underlying server (with web server user privileges, typically www-data or apache).
• Access to the Laravel application's environment configuration (.env file), which typically contains database credentials, application keys, and mail server credentials.
• Potential lateral movement to the database server (commonly MySQL/PostgreSQL), enabling data exfiltration of CMS content, user records, and sensitive business data.
• Use of the compromised server as a foothold for further network intrusion.

Likelihood assessment: The vulnerability requires a publicly accessible form with an upload field. Many Statamic deployments use forms for job applications, contact forms with attachments, or submission portals — these are common enough that the attack surface is realistic. However, the lack of public PoC and no confirmed in-the-wild exploitation (EPSS percentile 63.1% suggests moderate interest) suggests this may not yet be widely exploited.

Impact Assessment

CVSS Analysis (Score: 8.4 — High):

• Attack Vector: Network (AV:N): The vulnerability is exploitable remotely via HTTP requests to the front-end form.
• Attack Complexity: Low (AC:L): The attacker does not need to bypass authentication (forms are meant to be public) and the file crafting is straightforward.
• Privileges Required: Low (PR:L): Two scenarios — either no authentication (if the form is public, which is the default for "Forms" feature) or low-privileged authenticated access (if the site restricts access). Since the description does not detail authentication requirements, low pr 的 assumption is conservative.
• User Interaction: None (UI:N): No victim interaction is required — the attacker uploads the file and triggers execution themselves.
• Scope: Unchanged (S:U): The impact is limited to the affected component's security authority.
• Confidentiality/Integrity/Availability: High (C:H/I:H/A:H): Full system compromise is possible.

Business Impact:

• Criticality: The 8.4 CVSS score reflects near-complete compromise of the affected system.
• Data Breach Risk: Successful exploitation exposes database contents, including potentially PII collected through forms — a data privacy (GDPR/CCPA) incident.
• Compliance: Organizations in regulated industries (financial, healthcare) risk regulatory fines.
• Availability: Attackers can deface the website, disrupt services, or install ransomware.

Affected Systems:

• Statamic CMS 3.x prior to 3.4.13
• Statamic CMS 4.x prior to 4.33.0
• Any deployment using the "Forms" feature with asset upload capabilities
• Shared hosting environments amplify impact — a compromise could pivot to other tenants.

Blast Radius:

• Direct: Web server, application database, file storage.
• Indirect: Connected systems (mail servers, CDN origins, CI/CD pipelines).

Detection Guidance

Sigma Rule

title: Statamic CMS - Suspicious File Upload via Forms Feature
id: 8f3e2a1b-6c4d-4e8f-9a2b-0c1d2e3f4a5b
status: experimental
description: Detects attempts to upload files with PHP content disguised as images through Statamic CMS front-end forms (CVE-2023-47129)
author: Valtersit Threat Intelligence
date: 2024-01-15
logsource:
  category: webserver
  product: apache
  definition: 'Web server access logs for Apache, Nginx, IIS'
detection:
  selection_upload:
    cs-method: 'POST'
    cs-uri-extension:
      - '.php'
      - '.phtml'
      - '.php5'
      - '.php7'
  selection_multipart:
    cs-content-type: 'multipart/form-data*'
  selection_statamic_path:
    cs-uri-query|contains:
      - '/forms/'
      - '/!/forms/'
      - 'assets'
  condition: selection_upload and selection_multipart and selection_statamic_path
falsepositives:
  - Legitimate form submissions with file attachments
  - Legitimate maintenance operations with PHP uploads
level: high
fields:
  - clientip
  - cs-uri-stem
  - cs-uri-query
  - cs-user-agent

YARA Rule

rule Statamic_CVE_2023_47129_Polyglot_Upload
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects polyglot files combining image headers with PHP code targeting Statamic CMS Forms upload"
        cve = "CVE-2023-47129"
        date = "2024-01-15"
        reference = "NVD Description, CNA Title"
    strings:
        // PHP code indicators
        $php_tag = "<?php" ascii
        $php_short = "<?" ascii
        $php_eval = "eval(" ascii
        $php_system = "system(" ascii
        $php_exec = "exec(" ascii
        $php_shell_exec = "shell_exec(" ascii
        $php_base64 = "base64_decode(" ascii
        // Image magic bytes
        $jpeg = { FF D8 FF E0 }
        $jpeg2 = { FF D8 FF E1 }
        $png = { 89 50 4E 47 0D 0A 1A 0A }
        $gif = { 47 49 46 38 39 61 }
        $bmp = { 42 4D }
        $webp = { 52 49 46 46 ?? ?? ?? ?? 57 45 42 50 }
    condition:
        // File starts with image header (first 32 bytes)
        (uint32(0) == 0xE0FFD8FF or uint32(0) == 0xE1FFD8FF or
         uint32(0) == 0x474E5089 or uint32(0) == 0x38464947 or
         uint32(0) == 0x4D4242) and
        // But contains PHP code later in the file
        any of ($php_*) and
        // And has an extension mismatch (image extension but PHP content)
        filesize > 200
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT Statamic CMS CVE-2023-47129 Polyglot PHP Image Upload Attempt";
    flow:established,to_server;
    http.method; content:"POST";
    http.content_type; content:"multipart/form-data";
    http.uri; content:"/forms/"; nocase;
    http.request_body; content:"filename="; nocase;
    http.request_body; content:".php"; nocase;
    http.request_body; content:"Content-Type";
    http.request_body; content:"image/"; nocase;
    pcre:"/filename=["^"]*\.(php|phtml|php5|php7)([^a-z]|$)/i";
    pcre:"/Content-Type:\s*image\/[a-z0-9.+-]+/i";
    pcre:"/<\?php|<\?=/i";
    classtype:attempted-admin;
    reference:cve,2023-47129;
    sid:2024003101;
    rev:1;
    metadata:created_at 2024-01-15, updated_at 2024-01-15;
)

Elastic Detection

// Elastic EQL rule - detection of suspicious file uploads to Statamic forms
sequence by host.name, source.ip with maxspan=30s
  [network where event.type == "connection" and direction == "ingress"
   and destination.port in (80, 443)]
  [http where event.action == "request" and http.request.method == "POST"
   and http.request.uri contains "/forms/"
   and http.request.body.content_type == "multipart/form-data"
   and http.request.body.content contains "filename="
   and (http.request.body.content matches ".*\\.(php|phtml|php5|php7).*"
        or http.request.body.content matches ".*<\\?php.*"
        or http.request.body.content matches ".*\\?>=.*")]
  [file where event.action in ("create", "write")
   and file.extension in ("php", "phtml", "php5", "php7")
   and file.path contains "assets"]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx OR sourcetype=iis
| where method="POST"
| search uri="*/forms/*"
| regex _raw "(?i)multipart/form-data"
| regex _raw "(?i)filename=.*\.(php|phtml|php5|php7)"
| regex _raw "(?i)Content-Type: image/(jpeg|png|gif|bmp|webp)"
| eval php_in_body=if(match(_raw, "(?i)<\?php|<\?="), "YES", "NO")
| where php_in_body="YES"
| stats count by src_ip, uri, status, _time
| sort - _time
| rename src_ip as "Source IP", uri as "Request URI", status as "HTTP Status", count as "Attempt Count"
| table _time, "Source IP", "Request URI", "HTTP Status", "Attempt Count"

Wazuh OSSEC Rule

<group name="statamic,">
  <rule id="100471" level="15">
    <if_sid>31100</if_sid>
    <match>POST</match>
    <regex>\/forms\/</regex>
    <regex>filename=.*\.(php|phtml|php5|php7)</regex>
    <regex>Content-Type: image\/</regex>
    <description>Statamic CMS (CVE-2023-47129): Upload attempt of PHP file disguised as image via front-end form</description>
    <group>attack.upload,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED per available intelligence. While the vendor fixed in versions 3.4.13 and 4.33.0, the tracker reports no confirmed patch evidence from tracked sources. Confirm with your vendor/distribution channel.

1) Immediate Mitigations (without applying the patch):

• Disable asset upload fields on all front-end forms until patched. In the Statamic control panel, edit each form's blueprint and remove the asset upload field (Assets fieldtype).
• If uploads are essential, restrict file extensions at the web server level (Apache/Nginx) by blocking .php, .phtml, .php5, .php7 execution in the asset upload directory using location directives or .htaccess rules.
• Disable PHP execution in asset directories: Configure the web server to not execute PHP files within the storage/assets path.
• Implement a Web Application Firewall (WAF) rule to inspect multipart uploads for polyglot PHP-image content patterns.
• Restrict form access: If the forms are behind a login, require authenticated access with elevated privileges.

2) Patch/Upgrade Steps:

• Upgrade Statamic CMS: Run composer update statamic/cms to upgrade to at least:
  • Version 3.4.13 or later for the 3.x branch.
  • Version 4.33.0 or later for the 4.x branch.
• After upgrade, verify the asset upload validation now checks the actual file content (e.g., uses getimagesize() or similar robust validation) rather than just extension/MIME headers.
• Test forms thoroughly post-patch to ensure legitimate image files still upload correctly.

3) Long-Term Hardening:

• Run assets from a separate domain/serving path where PHP execution is disabled (e.g., serve from CDN).
• Implement strict MIME whitelist validation at the application level — verify the actual file signature matches the declared content type using server-side functions.
• Scan uploaded files with an anti-malware engine (e.g., ClamAV) as an additional layer.
• Separate the web server from the database server with proper network segmentation.
• Adopt the principle of least privilege for the web server user — do not run as root; restrict filesystem writes to required directories.
• Enable robust logging of all uploads, including file hashes, IP address, and form submission metadata.
• Subscribe to Statamic security advisories to stay informed of future vulnerability disclosures.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-47129 (NVD Description: Statamic CMS remote code execution via front-end form uploads)
2. CNA Title Reference: "Statamic CMS remote code execution via front-end form uploads" — original CNA disclosure by Statamic.
3. GitHub Advisory (expected location): https://github.com/statamic/cms/security/advisories — advisory for GHSA associated with CVE-2023-47129 (patch in 3.4.13, 4.33.0). Note: Verify directly; not confirmed in provided data.
4. Statamic Releases/Blog: https://statamic.com/changelog — official changelog confirming security fixes in versions 3.4.13 and 4.33.0.
5. CISA KEV: Not listed — no known exploitation in the wild as of the data date.

Threat Actor/TTP Notes: No known threat actor campaigns or exploit-in-the-wild evidence were identified in the provided data. The EPSS score of 0.01121 (63.1st percentile) suggests the vulnerability has received some attention in the exploit prediction community but has not been widely exploited. The moderate EPSS percentile, combined with a high CVSS score, suggests this CVE should be prioritized for patching despite the lack of confirmed in-the-wild exploitation. Monitor vendor channels and security research blogs for potential PoC disclosures, which typically precede mass exploitation.