CVE-2024-54149·PHP vulnerability
Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such as theme customisation values or modify, or remove, templates in the theme even if not provided direct access via the permissions. As all objects passed through to Twig are references to the live objects, it is also possible to also manipulate model data if models are passed directly to Twig, including changing attributes or even removing records entirely. In most cases, this is unwanted behavior and potentially dangerous. To actively exploit this security issue, an attacker would need access to the Backend with a user account with any of the following permissions: `cms.manage_layouts`; `cms.manage_pages`; or `cms.manage_partials`. The Winter CMS maintainers strongly recommend that these permissions only be reserved to trusted administrators and developers in general. The maintainers of Winter CMS have significantly increased the scope of the sandbox, effectively making all models and datasources read-only in Twig, in versions 1.2.7, 1.1.11, and 1.0.476. Thse who cannot upgrade may apply commit fb88e6fabde3b3278ce1844e581c87dcf7daee22 to their Winter CMS installation manually to resolve the issue. In the rare event that a Winter user was relying on being able to write to models/datasources within their Twig templates, they should instead use or create components to make changes to their models.
- Severity
- high
- Software
- PHP
- Fixed in
- 1.2.7
- Published
- 2024-12-09
Affected versions
From: 1.2.0
Until: 1.2.7
Fixed in: 1.2.7
How to fix this CVE
Winter CMS installations running versions 1.2.0 through 1.2.6 must be upgraded to version 1.2.7 or later to patch a critical Twig sandbox bypass vulnerability. This flaw allows authenticated backend users with template management permissions to escape sandbox restrictions and directly manipulate theme data and models. If immediate upgrade is not possible, apply commit fb88e6fabde3b3278ce1844e581c87dcf7daee22 manually to your Winter CMS installation.
sudo dnf update php php-common php-cli php-fpmDefensia detects this vulnerability
How to check if you are affected
- Check your Winter CMS version by examining the version constant in config/app.php or the composer.lock file: grep -i 'version' config/app.php | head -5
- List all backend user accounts with CMS template management permissions by querying the database: SELECT * FROM backend_users WHERE role_id IN (SELECT id FROM backend_roles WHERE permissions LIKE '%cms.manage_layouts%' OR permissions LIKE '%cms.manage_pages%' OR permissions LIKE '%cms.manage_partials%');
- Search backend audit logs for suspicious Twig template modifications: grep -r 'modify.*twig\|template.*change' storage/logs/ --include='*.log'
- Verify the patched version by checking the Winter CMS version string matches 1.2.7 or higher: php -r "echo \\Winter\\System\\Classes\\Version::VERSION;" or inspect composer.lock for wintercms/winter version field
FAQ
What is CVE-2024-54149?
CVE-2024-54149 is a Twig sandbox bypass vulnerability in Winter CMS that allows authenticated backend users with template editing permissions to escape sandbox restrictions, directly manipulate theme configuration, models, and datasources despite permission controls intended to prevent such access.
Is CVE-2024-54149 being actively exploited?
No, CVE-2024-54149 is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploits are available, though the vulnerability is readily exploitable by any authenticated user with the specified backend permissions.
What versions of Winter CMS are affected by CVE-2024-54149?
Winter CMS versions 1.2.0 through 1.2.6 are affected. Versions 1.0.476, 1.1.11, and 1.2.7 or later contain the patch.
How do I check if my server is vulnerable to CVE-2024-54149?
Run: php -r "require 'bootstrap/app.php'; echo \\Winter\\System\\Classes\\Version::VERSION;" and verify the version is below 1.2.7. Additionally, check if backend users with cms.manage_layouts, cms.manage_pages, or cms.manage_partials permissions exist.
Does Defensia detect CVE-2024-54149?
Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If Winter CMS or PHP is installed on a monitored server, CVE-2024-54149 will appear in your dashboard with remediation steps.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-54149. Free for 1 server.
Get started free