Unauthenticated Exposure of Yii Debug and Gii Modules in yii2-starter-kit

yii2-starter-kit versions through 4.2.0 contain a critical configuration vulnerability (CVE-2026-103475) that leaves the Yii debug and Gii modules exposed to all IP addresses. By default, the application sets the 'allowedIPs' parameter to ['*'], enabling unauthenticated remote access to these administrative endpoints.

The debug module allows unauthorized users to view sensitive application internals, including session cookies, environment variables, and database query logs, facilitating further attacks or account takeovers. The Gii module is a code generation tool that allows users to create and write PHP files directly into the application directory. Attackers can leverage this functionality to perform remote code execution by injecting and executing arbitrary PHP code. Because these endpoints are often exposed without requiring authentication in this misconfigured state, an attacker needs only network reachability to the web application to achieve full system compromise.

Attack Chain

1. Attacker performs reconnaissance to identify applications running yii2-starter-kit by fingerprinting web headers or file paths.
2. Attacker probes for the presence of the Yii debug module via common paths such as /debug/default/index.
3. Attacker accesses the exposed debug endpoint to harvest sensitive data, including session cookies and database credentials found in logs.
4. Attacker navigates to the Gii module endpoint, typically located at /gii.
5. Attacker utilizes Gii code generation features to create a new controller or model containing arbitrary PHP malicious payloads.
6. Attacker triggers the writing of the crafted PHP file into the application's source directory.
7. Attacker navigates to the newly created file URL to trigger code execution.
8. Final objective achieved: remote command execution leading to full application control or data exfiltration.

Impact

Successful exploitation allows unauthenticated remote attackers to obtain sensitive information, including session identifiers and database contents, or achieve remote code execution by injecting arbitrary PHP files into the application directory. This affects all deployments of yii2-starter-kit versions 4.2.0 and earlier using the default development configuration, potentially impacting any organization running this starter kit in a production environment.

Recommendation

1. Immediately audit all instances of yii2-starter-kit to identify if the development configuration is active in production.
2. Restrict access to /debug and /gii endpoints via web server configuration (e.g., Nginx/Apache) or by updating the application configuration to limit 'allowedIPs' to trusted internal addresses.
3. Update yii2-starter-kit to a version that enforces secure default configurations, or explicitly disable the debug and Gii modules in production environments.
4. Review web server logs for HTTP requests directed at /debug/* or /gii/* paths originating from unauthorized external IP addresses.