Craft-Commerce - CraftedSignal Threat Feed

Craft Commerce SQL Injection Leading to Remote Code Execution

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A critical vulnerability exists in Craft Commerce versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4. This vulnerability allows any authenticated control panel user to achieve remote code execution (RCE) on the target server. The attack leverages a SQL injection flaw in the TotalRevenue widget, where unsanitized widget settings are directly interpolated into a SQL expression. The default configuration of PHP's PDO MySQL, which enables CLIENT_MULTI_STATEMENTS, is exploited to inject additional SQL statements. This allows the attacker to write a maliciously serialized PHP object into the queue table. The yii2-queue PhpSerializer then unserializes this object without restrictions, leading to instantiation of an attacker-controlled object. Finally, a gadget chain within the GuzzleHttp\Cookie\FileCookieJar dependency is used to write a PHP webshell to the server's webroot. This complex chain of vulnerabilities culminates in arbitrary command execution as the PHP process user. Queue processing is triggered via GET /actions/queue/run, an endpoint that requires no authentication.

Attack Chain

An attacker authenticates to the Craft Commerce control panel as any user.
The attacker sends a POST request to /admin/actions/dashboard/create-widget to create a TotalRevenue widget.
The settings[type] parameter in the POST request contains a stacked SQL injection payload. This payload leverages CLIENT_MULTI_STATEMENTS to inject an INSERT statement after the initial SELECT query. The INSERT statement writes a serialized PHP object into the queue table.
The server returns an HTTP 500 error, indicating the INSERT statement was successfully committed.
The attacker triggers queue processing by sending a GET request to /actions/queue/run.
The queue consumer deserializes the injected PHP object from the queue table using unserialize(), without any allowed classes restrictions.
This deserialization triggers the __destruct() method of the GuzzleHttp\Cookie\FileCookieJar class, which contains an unguarded call to file_put_contents(). This writes a PHP webshell (e.g., poc_rce.php) to the webroot.
The attacker accesses the webshell via a GET request (e.g., GET /poc_rce.php?c=id), executing arbitrary commands as the PHP process user.

Impact

Successful exploitation allows an attacker to execute arbitrary code on the Craft Commerce server as the PHP process user. This can lead to complete system compromise, including data theft, modification, or destruction. Given the nature of e-commerce platforms, this could result in significant financial loss, reputational damage, and legal repercussions. The fact that any authenticated control panel user can trigger this vulnerability significantly widens the attack surface. This vulnerability impacts all versions of Craft Commerce between 4.0.0 and 4.10.2 and between 5.0.0 and 5.5.4.

Recommendation

Immediately upgrade Craft Commerce to a patched version (4.10.3+ or 5.5.5+) to remediate CVE-2026-32271.
Deploy the Sigma rule "Craft Commerce Webshell Creation via FileCookieJar" to detect webshell creation attempts via file_put_contents.
Monitor web server logs for requests to /actions/queue/run to detect unauthorized queue processing, referencing the attack chain description.
Consider disabling CLIENT_MULTI_STATEMENTS in your PHP PDO configuration if possible, but be aware of potential compatibility issues.

Craft Commerce Blind SQL Injection via hasVariant/hasProduct Properties

hello@craftedsignal.io — Wed, 03 Jan 2024 12:00:00 +0000

A blind SQL injection vulnerability has been identified in Craft Commerce, specifically affecting the ProductQuery::hasVariant and VariantQuery::hasProduct properties. This vulnerability bypasses a blocklist implemented in ElementIndexesController (GHSA-2453-mppf-46cj) intended to prevent SQL injection attacks. The bypass occurs because the blocklist only filters top-level Yii2 Query properties, while hasVariant and hasProduct pass through without sanitization. These properties then call Craft::configure() on a subquery, reintroducing the SQL injection vulnerability via a crafted criteria[hasVariant][where]=INJECTED_SQL parameter. This flaw allows an authenticated user of the control panel to perform boolean-based blind SQL injection and extract sensitive information from the database. The vulnerability affects composer/craftcms/commerce versions 5.0.0 to before 5.6.0.

Attack Chain

Attacker authenticates to the Craft Commerce control panel.
Attacker crafts a malicious HTTP request targeting the ElementIndexesController.
The crafted request includes a criteria[hasVariant][where] parameter containing the SQL injection payload.
The ElementIndexesController processes the request and calls the hasVariant or hasProduct property.
Craft::configure() is invoked on a subquery without proper sanitization, injecting the malicious SQL.
The database executes the injected SQL query, performing boolean-based comparisons.
Attacker infers database content based on response times or boolean results, exfiltrating data bit by bit.
Attacker extracts sensitive information like security keys to forge admin sessions, leading to full control.

Impact

Successful exploitation of this vulnerability grants attackers full read access to the Craft Commerce database. This includes sensitive data such as user credentials, API keys, and financial information. By extracting the security key, an attacker can forge administrative sessions, leading to complete control over the compromised Craft Commerce instance. This could lead to data breaches, financial loss, and reputational damage. While the number of affected installations is unknown, any Craft Commerce installation with the Commerce plugin installed and products with variants created is potentially vulnerable.

Recommendation

Upgrade composer/craftcms/commerce to version 5.6.0 or later to patch CVE-2026-32272.
Deploy the Sigma rules provided below to detect potential exploitation attempts targeting the ElementIndexesController.
Monitor web server logs for suspicious requests containing criteria[hasVariant][where] or criteria[hasProduct][where] parameters with potentially malicious SQL syntax.
Implement web application firewall (WAF) rules to filter out requests containing SQL injection payloads in the criteria[hasVariant][where] and criteria[hasProduct][where] parameters.