https://feed.craftedsignal.io/vendors/ci4ms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 30 Jan 2024 12:00:00 +0000https://feed.craftedsignal.io/briefs/2024-01-30-ci4ms-takeover/Tue, 30 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-30-ci4ms-takeover/CI4MS versions before 0.31.4.0 are vulnerable to unauthenticated takeover due to a flawed install route guard that allows overwriting the .env file with attacker-controlled database credentials when the database is temporarily unreachable.CI4MS, a CodeIgniter 4-based CMS skeleton, is vulnerable to a critical security flaw (CVE-2026-39393) in versions prior to 0.31.4.0. The vulnerability stems from an insufficient install route guard mechanism. This guard, designed to prevent unauthorized access to the setup wizard after installation, relies on a combination of a volatile cache check (cache('settings')) and the presence of the .env file. When the database becomes temporarily unreachable, leading to a cache miss (either due to TTL expiry or manual cache clearing), the route guard fails open. This failure enables an unauthenticated attacker to access the setup wizard and overwrite the .env file with maliciously crafted database credentials. Successful exploitation leads to complete application takeover. The vulnerability was patched in version 0.31.4.0.

Attack Chain

1. The target CI4MS instance experiences a database outage or becomes temporarily unreachable.
2. The cache('settings') check in the install route guard fails due to a cache miss caused by the database outage.
3. The flawed logic in the route guard incorrectly determines that the application is not yet installed.
4. An unauthenticated attacker accesses the /install route, bypassing the intended security controls.
5. The attacker interacts with the setup wizard, providing malicious database credentials.
6. The application proceeds to overwrite the existing .env file with the attacker-supplied database configuration.
7. The attacker gains full administrative access to the CI4MS application using the newly configured database credentials.
8. The attacker can then execute arbitrary code, modify content, and compromise sensitive data within the CI4MS application.

Impact

Successful exploitation of CVE-2026-39393 allows an unauthenticated attacker to achieve full application takeover of CI4MS instances running versions prior to 0.31.4.0. This can lead to complete data breaches, website defacement, and potential compromise of the underlying server. The severity is critical due to the ease of exploitation and the potential for widespread damage. The number of affected systems depends on the number of CI4MS installations that have not been upgraded to version 0.31.4.0 or later.

Recommendation

• Immediately upgrade all CI4MS installations to version 0.31.4.0 or later to patch CVE-2026-39393.
• Implement network monitoring for unusual access attempts to the /install route on CI4MS instances.
• Deploy the Sigma rule Detect CI4MS Install Route Access to detect unauthorized access attempts to the vulnerable installation route.
• Review webserver logs for POST requests to the /install route with parameters suggestive of database configuration changes. Use the Sigma rule Detect CI4MS Env Overwrite as a starting point.

]]>criticaladvisoryCVE-2026-39393CI4MSCodeIgniterRemote Code ExecutionUnauthenticated Accesshttps://feed.craftedsignal.io/briefs/2024-01-02-ci4ms-env-injection/Tue, 02 Jan 2024 12:00:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2024-01-02-ci4ms-env-injection/CI4MS versions prior to 0.31.4.0 are vulnerable to .env file injection via the Install::index() controller due to insufficient input validation and bypassed CSRF protection, allowing attackers to inject arbitrary configuration directives.CI4MS is a CodeIgniter 4-based CMS skeleton designed to provide a production-ready, modular architecture with features like RBAC authorization and theme support. Versions prior to 0.31.4.0 contain a critical vulnerability (CVE-2026-39394) within the Install::index() controller. This controller reads the 'host' POST parameter without proper validation and passes it directly to the updateEnvSettings() function. This function, in turn, uses preg_replace() to write the value into the .env file. The lack of newline character stripping in the input allows an attacker to inject arbitrary configuration directives. Furthermore, the installation routes have CSRF protection explicitly disabled, and the InstallFilter can be bypassed when the cache('settings') is empty, such as during initial deployment or after cache expiry. This vulnerability allows unauthenticated attackers to modify the application's configuration, leading to potentially complete system compromise. CI4MS deployments are vulnerable until upgraded to version 0.31.4.0 or later.

Attack Chain

1. An unauthenticated attacker sends a POST request to the /install route with a malicious 'host' parameter.
2. The Install::index() controller receives the POST request.
3. The controller bypasses CSRF protection due to it being explicitly disabled.
4. The InstallFilter is bypassed because the cache('settings') is empty (e.g., on a fresh deployment).
5. The 'host' parameter, containing injected configuration directives with newline characters, is passed to the updateEnvSettings() function.
6. The updateEnvSettings() function uses preg_replace() to write the attacker-controlled 'host' parameter into the .env file without proper sanitization.
7. The injected configuration directives are written into the .env file, modifying the application's configuration.
8. The attacker can now leverage the modified configuration for further malicious activities, such as gaining unauthorized access, escalating privileges, or injecting malicious code.

Impact

Successful exploitation of this vulnerability allows an attacker to inject arbitrary configuration directives into the .env file. This can lead to a wide range of consequences, including but not limited to: database credential compromise, modification of application behavior, remote code execution, and complete system takeover. The number of potential victims is dependent on the number of CI4MS deployments running vulnerable versions (pre-0.31.4.0). Targeted sectors are likely to be diverse, reflecting the broad range of applications for which CI4MS is used.

Recommendation

• Upgrade CI4MS to version 0.31.4.0 or later to patch CVE-2026-39394.
• Monitor web server logs for POST requests to the /install route containing newline characters in the 'host' parameter to detect potential exploitation attempts. Implement the provided Sigma rules to detect this activity.
• Implement strict input validation on all user-supplied data, especially for parameters that are used to modify configuration files.
• Ensure that CSRF protection is enabled and functioning correctly for all sensitive routes, including installation routes.

]]>highadvisoryci4mscodeigniterenv-injectioncve-2026-39394