CVE-2024-52292

Executive Summary

CVE-2024-52292 is a high-severity arbitrary file read vulnerability in Craft CMS, a popular content management system. The flaw resides in the dataUrl function, which can be abused by an attacker with write permissions on system notification templates. By embedding a call to dataUrl with an absolute file path (e.g., /etc/passwd), the attacker can force the CMS to read the file, Base64-encode its contents, and include the encoded string in a triggered system email notification. Once the attacker receives the email, they can decode the Base64 payload to read sensitive files on the server. This vulnerability is particularly dangerous because it allows privilege escalation from a low-privileged author/editor role to full server compromise. The patch restricts the dataUrl function to only accept relative paths within the webroot, preventing arbitrary file reads.

Supply Chain & Package Security

Craft CMS is distributed as a Composer package via Packagist. The vulnerability affects the core CMS package (craftcms/cms). Users should ensure they are using a patched version (4.12.8 or 5.4.9) and verify the integrity of their Composer dependencies. No malicious packages have been reported in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires write access to system notification templates
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the low complexity and the potential for sensitive data exfiltration (e.g., database credentials, configuration files, SSH keys).

Deep Dive & Mechanics

The vulnerability is rooted in the dataUrl function, which is part of Craft CMS's Twig extension. This function is designed to convert a file's content into a Base64-encoded data URL for embedding images or other assets directly into templates. However, the function does not validate whether the provided path is absolute or relative, nor does it restrict the path to the webroot.

Attack Flow:

1. Prerequisite: The attacker must have write permissions on system notification templates. In Craft CMS, this typically requires an author or editor role with access to the control panel.
2. Template Injection: The attacker edits a system notification template (e.g., email notification for user registration) and inserts a Twig expression like {{ dataUrl('/etc/passwd') }}.
3. Trigger: The attacker triggers the notification (e.g., by registering a new user or performing an action that sends the email).
4. Exfiltration: The CMS processes the template, reads /etc/passwd, Base64-encodes its content, and includes the encoded string in the email body.
5. Decoding: The attacker receives the email, extracts the Base64 string, and decodes it to read the file contents.

Why It Works:

• The dataUrl function uses PHP's file_get_contents() internally, which accepts absolute paths.
• No path sanitization or restriction is applied.
• System notification templates are rendered with full server-side privileges.

Vulnerable vs. Patched Code

Vulnerable Code (Craft CMS < 4.12.8 / < 5.4.9):

public function dataUrl($path)
{
    $data = file_get_contents($path);
    return 'data:' . mime_content_type($path) . ';base64,' . base64_encode($data);
}

Patched Code (Craft CMS >= 4.12.8 / >= 5.4.9):

public function dataUrl($path)
{
    // Restrict to relative paths within the webroot
    if (strpos($path, '..') !== false || strpos($path, '/') === 0) {
        throw new \yii\base\InvalidArgumentException('Invalid path.');
    }
    $fullPath = \Craft::getAlias('@webroot') . '/' . $path;
    if (!file_exists($fullPath)) {
        throw new \yii\base\InvalidArgumentException('File not found.');
    }
    $data = file_get_contents($fullPath);
    return 'data:' . mime_content_type($fullPath) . ';base64,' . base64_encode($data);
}

The patch adds validation to reject absolute paths (starting with /) and path traversal sequences (..), ensuring only files within the webroot can be read.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Craft CMS instance (version < 4.12.8 or < 5.4.9)
• An account with write access to system notification templates (e.g., author/editor role)

Steps:

1. Log in to the Craft CMS control panel.
2. Navigate to Settings → Email → System Notifications.
3. Edit an existing notification template (e.g., "Account Activation").
4. Insert the following Twig code into the template body:

   {{ dataUrl('/etc/passwd') }}
   

5. Save the template.
6. Trigger the notification (e.g., create a new user account that requires activation).
7. Check the email inbox for the notification. The email body will contain a Base64-encoded string.
8. Decode the Base64 string:

   echo "BASE64_STRING" | base64 -d
   

Alternative Payloads:

• Read database config: {{ dataUrl('/var/www/html/.env') }}
• Read SSH keys: {{ dataUrl('/home/ubuntu/.ssh/id_rsa') }}

Blue Team (Detection & Response)

Detection:

• Monitor for unusual Base64 strings in email notifications.
• Audit system notification templates for unexpected Twig expressions.
• Monitor file access logs for reads to sensitive files (e.g., /etc/passwd, .env).

Response:

1. Immediately revoke write permissions for any suspicious accounts.
2. Review and sanitize all system notification templates.
3. Rotate any credentials that may have been exposed (database passwords, API keys, SSH keys).
4. Apply the patch by upgrading to Craft CMS 4.12.8 or 5.4.9.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, .env, config/db.php, config/general.php
• Email Content: Emails containing Base64-encoded strings that decode to sensitive file contents.
• Log Entries: PHP error logs showing file_get_contents() calls with absolute paths.
• Twig Templates: System notification templates containing {{ dataUrl(...) }} expressions.

Detection Engineering

YARA Rule

rule CVE_2024_52292_CraftCMS_FileRead {
    meta:
        description = "Detects attempts to exploit CVE-2024-52292 in Craft CMS via Twig templates"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-52292"
    strings:
        $twig_payload = /{{ dataUrl\(['"][\/\\]?[a-zA-Z0-9_\/\\.]+['"]\) }}/
        $sensitive_path = /\/etc\/(passwd|shadow|hosts)|\.env|config\/db\.php/
    condition:
        $twig_payload and $sensitive_path
}

Sigma Rule

title: Craft CMS Arbitrary File Read via dataUrl Function
id: 8f3b2c1a-5d7e-4f9b-8a1c-3e6d2f4b5a7c
status: experimental
description: Detects exploitation of CVE-2024-52292 by monitoring for Base64-encoded file contents in email notifications.
author: Valters IT
logsource:
    product: email
    service: smtp
detection:
    selection:
        body|contains: "data:"
    condition: selection
falsepositives:
    - Legitimate use of data URLs in emails
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-52292 Craft CMS Arbitrary File Read via Email"; flow:to_server,established; content:"data:"; http_client_body; pcre:"/data:[a-zA-Z0-9+\/=]+;base64,/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Craft CMS to version 4.12.8 or 5.4.9 (or later).
2. Audit all system notification templates for any suspicious Twig expressions.
3. Review user permissions and revoke write access to notification templates for non-admin roles.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block requests containing dataUrl( in POST data.
• Enable file integrity monitoring (FIM) on critical system files.
• Restrict PHP's file_get_contents() to the webroot using open_basedir in php.ini.
• Conduct regular security audits of custom Twig extensions.

Patch Verification:

• After upgrading, verify the patch by attempting to use dataUrl with an absolute path in a template. It should throw an error.

Valters IT
Securing Digital Frontiers