Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components.

Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate().

This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process.

The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.

Prerequisites

• Give the user Control Panel access.
• Ensure at least one entry type and one entry exist. They do not need to correspond because typeId is overridden in memory.
• Sign in as the limited user and record:
  • the authenticated session/Cookie header;
  • the raw csrfTokenValue returned by Craft for that session;
  • the numeric ID of an existing entry type;
  • the numeric element ID of an existing entry.

This is an authenticated OS command execution vulnerability. A malicious or compromised low-privileged Control Panel account can cross from application-level access to code execution as the PHP/web-server service account.

Depending on that operating-system account’s permissions, exploitation may allow the attacker to:

• read Craft security keys, database credentials, and environment configuration available to PHP;
• read or modify site content and user data;
• modify application files writable by the web-server account and establish persistence;
• access internal services reachable from the Craft host; or
• disrupt availability.

The exploit does not require allowAdminChanges, project-config modification, Kubernetes object access, environment-variable control, prior filesystem access, root privileges, poison injection from another system, or exploitation of an upstream dependency vulnerability.