Craft CMS Authenticated RCE via Twig Sandbox Escape

Craft CMS versions prior to 5.10.7 and 4.18.3 contain a vulnerability in their Twig template sandbox implementation. The sandbox uses a SecurityPolicy class that determines which methods and properties are accessible within user-defined templates. The vulnerability arises because the sandbox policy allows access to classes based on inheritance hierarchies. Specifically, the ElementInterface, which is marked as safe for the sandbox, is inherited by objects that eventually lead to the yii\base\Component class from the underlying Yii framework.

This framework class contains known gadgets that can be used to execute arbitrary functions. Because the sandbox policy does not properly restrict access to methods inherited from parent classes, an authenticated attacker who can modify or create Twig templates within the control panel can trigger these dangerous methods to achieve remote code execution (RCE). This issue represents a regression of previous security bypasses in the Craft CMS sandbox mechanism.

Impact

Successful exploitation allows an authenticated user with access to the control panel to execute arbitrary system code. This grants the attacker full control over the application environment. Given the high degree of access required, the vulnerability poses a significant risk to organizations managing content through the Craft CMS administrative interface.

Recommendation

• Upgrade Craft CMS installations to version 5.10.7 or 4.18.3 or higher to apply the security patch for the Twig sandbox.
• Audit permissions within the Craft CMS control panel to ensure that only trusted users have the ability to modify or save Twig templates.
• Review custom code that utilizes AllowedInSandbox attributes or custom class allowlists for potential exposure of underlying framework components.