Description
The _validatePost function in libs/controller/components/security.php in CakePHP 1.3.x through 1.3.5 and 1.2.8 allows remote attackers to modify the internal Cake cache and execute arbitrary code via a crafted data[_Token][fields] value that is processed by the unserialize function, as demonstrated by modifying the file_map cache to execute arbitrary local files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | cakephp | 1.3.2-1.1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
CakePHP Cache Corruption Code Execution
exploit/unix/webapp/cakephp_cache_corruption
Exploit-DB 2
- CakePHP 1.3.5/1.2.8 - 'Unserialize()' File Inclusion EDB-16011 · webapps · Jan 18, 2011
- CakePHP 1.3.5/1.2.8 - Cache Corruption (Metasploit) EDB-16902 · webapps · Jan 14, 2011 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | cakephp/cakephp | >= 1.2.8, < 1.3.6 | 1.3.6 | GHSA-g2vx-8v47-4vhh |
References
- https://github.com/cakephp/cakephp/commit/e431e86aa4301ced4273dc7919b59362cbb353cb
- 16011 exploit
- http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt
- 69352 vdb-entry
- 8026 third-party-advisory
- http://malloc.im/CakePHP-unserialize.txt
- 42211 third-party-advisory