{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-56145/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-56145/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-56145/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-56145/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-56145/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-56145"},"sightings":{"href":"/api/v1/sightings/cve-2024-56145"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-56145.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-56145\n\ninfo:\n  name: Craft CMS - Remote Code Execution via Template Path Manipulation\n  author: jackhax\n  severity: critical\n  description: |\n    This template identifies a critical Remote Code Execution (RCE) vulnerability in Craft CMS, identified as GHSA-2p6p-9rc9-62j9.\n    The vulnerability exists due to improper handling of the `--templatesPath` query parameter, allowing attackers to execute arbitrary code by referencing malicious Twig templates.\n  impact: |\n    Successful exploitation of this vulnerability could allow an unauthenticated attacker to perform remote code execution.\n  remediation: |\n    Upgrade CraftCMS to either >5.5.2 or >4.13.2 or >3.9.14. Or If you can't upgrade yet, and register_argc_argv is enabled, you can disable it to mitigate the issue.\n  reference:\n    - https://github.com/advisories/GHSA-2p6p-9rc9-62j9\n    - https://www.assetnote.io/resources/research/how-an-obscure-php-footgun-led-to-rce-in-craft-cms\n    - https://github.com/Chocapikk/CVE-2024-56145\n    - https://github.com/craftcms/cms/commit/82e893fb794d30563da296bca31379c0df0079b3\n    - https://github.com/craftcms/cms/security/advisories/GHSA-2p6p-9rc9-62j9\n  classification:\n    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N\n    cvss-score: 9.3\n    cve-id: CVE-2024-56145\n    cwe-id: CWE-94\n    epss-score: 0.97446\n    epss-percentile: 0.99897\n    cpe: cpe:2.3:a:craftcms:craft:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: craftcms\n    product: cms\n    shodan-query:\n      - http.html:\"craftcms\"\n      - http.favicon.hash:\"-47932290\"\n    fofa-query:\n      - icon_hash=-47932290\n      - body=craftcms\n    publicwww-query: craftcms\n  tags: cve,cve2024,rce,craftcms,ssti,kev,vkev,vuln\n\nvariables:\n  nonce: \"{{rand_int(1000000000,9999999999)}}\"\n\nhttp:\n  - raw:\n      - |\n        GET ?--configPath=/nuclei_test/{{nonce}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{nonce}}'\n          - 'mkdir()'\n          - 'Permission denied'\n          - 'No such file or directory'\n        condition: and\n\n      - type: status\n        status:\n          - 503\n# digest: 4b0a00483046022100a0a80a80959bef92e4f310727b5d1fb6d27c77416d5b488352568bf04c42b80c02210097df5d06abeb33fb73ff7573517d3db89856f54c53498862174a39e2bd1f8271:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-56145"}