CVE-2023-41892
CRITICAL EXPLOITED NUCLEICraft CMS unauthenticated Remote Code Execution (RCE)
Title source: metasploitExploitation Summary
CVE-2023-41892 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 7 public exploits from researchers including 0xfalafel, diegaccio, zaenhaxor, including a Metasploit module exploits/linux/http/craftcms_unauth_rce_cve_2023_41892.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-41892, an unauthenticated remote code execution vulnerability in Craft CMS versions 4.0.0-RC1 to 4.4.14. The exploit leverages deserialization via the `conditions/render` endpoint to execute arbitrary PHP code and deploy a webshell.
Description
Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in Craft CMS 4.4.15.
Exploits (7)
This repository contains a functional exploit for CVE-2023-41892, an unauthenticated remote code execution vulnerability in Craft CMS versions 4.0.0-RC1 to 4.4.14. The exploit leverages deserialization via the `conditions/render` endpoint to execute arbitrary PHP code and deploy a webshell.
This repository contains a functional Python exploit for CVE-2023-41892, targeting Craft CMS versions 4.0.0-RC1 to 4.4.14. The exploit leverages deserialization and file upload vulnerabilities to achieve remote code execution by deploying a malicious PHP file and spawning a reverse shell.
The repository contains a functional exploit script for CVE-2023-41892, a Craft CMS Remote Code Execution (RCE) vulnerability. The script sends a crafted POST request to trigger deserialization via the `conditions/render` endpoint, leading to arbitrary code execution (e.g., `phpinfo()`).
This repository contains functional exploit code for CVE-2023-41892, targeting a deserialization vulnerability in Craft CMS. The PoC demonstrates remote code execution (RCE) by uploading a webshell via Imagick manipulation, with both authenticated and unauthenticated variants.
The repository lacks actual exploit code and only provides generic mitigation advice for PHP object injection attacks. No technical details about CVE-2023-41892 are included.
This repository contains a functional exploit for CVE-2023-41892, a Remote Code Execution (RCE) vulnerability in Craft CMS. The exploit leverages deserialization and Imagick file handling to write a malicious PHP shell to the target system.
This Metasploit module exploits CVE-2023-41892, an unauthenticated RCE vulnerability in Craft CMS versions 4.0.0-RC1 to 4.4.14. It leverages PHP object instantiation in `ConditionsController` and Imagick's MSL to upload a malicious PHP webshell.
Nuclei Templates (1)
http.favicon.hash:-47932290 || cpe:"cpe:2.3:a:craftcms:craft_cms" || http.html:craftcms
icon_hash=-47932290 || body=craftcms
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L