Attack Chain

1. An attacker sends a request to the authentication API, users API, or any endpoint using $users->find() with a crafted user ID.
2. The crafted user ID contains path traversal sequences (e.g., ../) to navigate outside the intended user account directory.
3. Kirby CMS constructs a file path using the manipulated user ID to locate the user’s account directory within site/accounts/.
4. Due to insufficient validation, the path traversal sequences are not properly sanitized.
5. The application attempts to include an index.php file from the traversed path.
6. If a file named index.php exists in the traversed directory, it is included and executed by the PHP interpreter.
7. Depending on the contents of the included index.php, sensitive information may be disclosed or arbitrary code may be executed.
8. The attacker leverages the code execution to further compromise the system or exfiltrate data.

Impact

The path traversal vulnerability in Kirby CMS versions 5.3.0 through 5.4.0 can lead to arbitrary PHP file inclusion, allowing attackers to execute malicious code or disclose sensitive data. Successful exploitation enables attackers to probe the existence of arbitrary directories on the server, facilitating fingerprinting of the server setup, installed plugins, and content structure. This vulnerability is rated high severity because it’s pre-authentication and enables full system compromise if a vulnerable index.php file is reachable.

Recommendation

• Upgrade to Kirby CMS version 5.4.1 or later to patch the vulnerability as advised in the Kirby 5.4.1 release notes.
• Deploy the Sigma rule Detect Kirby CMS Path Traversal Attempt to detect exploitation attempts by monitoring HTTP requests with path traversal sequences.
• Monitor web server logs for requests containing ../ sequences in the user ID or email parameters to identify potential path traversal attempts.