Two vulnerabilities impacting Craft CMS were chained together in zero-day attacks to breach servers and steal data, with exploitation ongoing, according to CERT Orange Cyberdefense. According to a report by SensePost, the ethical hacking team of Orange Cyberdefense, the threat actors chained both of these vulnerabilities together to breach servers and upload a PHP file manager. To exploit this flaw, the attacker sent a malicious JSON payload that caused the PHP code in the session file to be executed on the server. The attack begins with the exploitation of CVE-2025-32432, which allows attackers to send a specially crafted request containing a "return URL" as a parameter that is saved in a PHP session file. In February, CISA also tagged a code injection (RCE) flaw tracked as CVE-2025-23209 in Craft CMS 4 and 5 as being exploited in attacks. Orange told BleepingComputer that they saw additional compromise steps, including additional uploads of backdoors and data exfiltration. While they did not update Yii to the latest version in Craft CMS, Orange says that the attack chain is still fixed. Craft CMS also fixed the CVE-2025-32432 flaw in versions 3.9.15, 4.14.15, and 5.6.17 on April 10th. Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. The vulnerabilities were discovered by Orange Cyberdefense's CSIRT, which was called in to investigate a compromised server. The second stage of the attack leveraged a flaw in the Yii framework (CVE-2024-58136), which Craft CMS utilizes. This allowed the attacker to install a PHP-based file manager on the server to compromise the system further. For full indicators of compromise, including IP addresses and file names, you can view the appendix in SensePost's report. Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and Administration Field Guide and the technical editor for Rootkits for Dummies.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Fri, 25 Apr 2025 19:45:07 +0000