Article Details
Scrape Timestamp (UTC): 2025-02-21 16:00:39.764
Original Article Text
Click to Toggle View
CISA flags Craft CMS code injection flaw as exploited in attacks. The U.S. Cybersecurity & Infrastructure Security Agency (CISA) warns that a Craft CMS remote code execution flaw is being exploited in attacks. The flaw is tracked as CVE-2025-23209 and is a high severity (CVSS v3 score: 8.0) code injection (RCE) vulnerability impacting Craft CMS versions 4 and 5. Craft CMS is a content management system (CMS) used for building websites and custom digital experiences. Not many technical details about CVE-2025-23209 are available, but exploitation isn't easy, as it requires the installation's security key to have already been compromised. In Craft CMS, the security key is a cryptographic key that secures user authentication tokens, session cookies, database values, and sensitive application data. The CVE-2025-23209 vulnerability only becomes an issue if an attacker has already obtained this security key, which opens the way to decrypt sensitive data, generate fake authentication tokens, or inject and execute malicious code remotely. CISA has added the flaw to KEV without sharing any information about the scope and origin of the attacks and who the targets are. Federal agencies have until March 13, 2025, to patch the Craft CMS flaw. The flaw has been patched in Craft version 5.5.8 and 4.13.8, so users are recommended to upgrade to those releases or later as soon as possible. If you suspect compromise, it is recommended that you delete old keys contained in '.env' files and generate new ones using php craft setup/security-key command. Note that key changes render any data encrypted with a previous key inaccessible. Along with CVE-2025-23209, CISA also added a vulnerability in Palo Alto Networks firewalls (CVE-2025-0111) to the Known Exploited Vulnerability catalog, setting the same deadline for March 13. This is a file read vulnerability impacting PAN-OS firewalls, which the vendor disclosed is exploited by hackers as part of an exploit chain with CVE-2025-0108 and CVE-2024-9474. For the PAN-OS versions that address this flaw, impacted users can check out Palo Alto Networks' security bulletin.
Daily Brief Summary
The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has identified an exploited remote code execution (RCE) vulnerability in Craft CMS, tracked as CVE-2025-23209.
This high-severity vulnerability (CVSS v3 score: 8.0) affects versions 4 and 5 of Craft CMS, a platform used for developing websites and digital content.
The exploitation of this security flaw relies on unauthorized access to Craft CMS's security key, which is essential for encrypting sensitive data and authentication.
Once the security key is compromised, attackers can decrypt data, forge authentication tokens, or remotely inject and execute malicious code.
To mitigate the risk, CISA has urged federal agencies to patch the flaw by updating to Craft CMS versions 5.5.8 or 4.13.8 before March 13, 2025.
CISA also recommends deleting old security keys and generating new ones if a compromise is suspected, noting that this will render data encrypted with the old key inaccessible.
In addition to CVE-2025-23209, CISA has also highlighted a critical vulnerability in Palo Alto Networks firewalls, urging similar precautions and patches by the same deadline.