Impact
Affected versions of Winter CMS allow authenticated backend users with the cms.manage_assets permission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an =include / =require directive in a theme JavaScript asset.
Winter\Storm\Parse\Assetic\Filter\JavascriptImporter processes =include / =require directives found in comment blocks of JavaScript assets passed through System\Classes\CombineAssets. The directive target was resolved relative to the including file's own directory with realpath() and inlined into the combined output with no confinement check, so a directive such as =include ../../../.env escaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had .js appended to them.
Because the combined output is served through the combine/{file} route, which performs no authentication or authorization checks, the disclosed contents then became readable by unauthenticated visitors at a stable URL as soon as the asset was referenced by any template.
The leaked content includes any file the web process can read, most importantly the application .env file (disclosing APP_KEY and database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.
This is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS @import directives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq — the same vulnerability class reached through a different asset combiner filter.
To actively exploit this issue, an attacker would need an authenticated backend account with the cms.manage_assets permission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that the cms.manage_assets permission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.
Patches
JavascriptImporter in Winter Storm now applies two independent gates to every =include / =require target:
- Only
.js targets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as .env, .php, and .log. Extension-less includes are unaffected, as they are resolved to .js before this check, exactly as before.
- The resolved path must lie within the including file's own directory subtree or one of the caller-configured allowed import roots, enforced through the new
PathResolver::withinAny() helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was =require).
The allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a HasAllowedImportRoots trait, and System\Classes\CombineAssets configures both — along with the CSS @import filter, using the import validator added in assetic/framework v3.2.1 — with themes_path(), plugins_path(), and base_path('modules') as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.
The backend permission descriptions for cms.manage_assets and cms.manage_content now also carry the same "should only be given to trusted users" warning that was already displayed for cms.manage_pages, cms.manage_layouts, and cms.manage_partials.
This security issue has been fixed in v1.2.13 (Winter core) and v1.2.13 (Winter Storm).
Workarounds
If you cannot upgrade, apply wintercms/storm@fd673f4 and wintercms/winter@e09c8d3 manually. As an interim mitigation, remove the cms.manage_assets permission from any role that is not held by a fully trusted administrator or developer, and audit existing theme .js assets for =include / =require directives that resolve outside the theme's own asset directory.
References
Credit to Zyad Mohamed Elmahy (@elmahy111) for reporting the issue.
For more information
If you have any questions or comments about this advisory:
References
elmahy111 Reporter
Impact
Affected versions of Winter CMS allow authenticated backend users with the
cms.manage_assetspermission ("Manage website assets - images, JavaScript files, CSS files") to disclose arbitrary files readable by the PHP process by placing an=include/=requiredirective in a theme JavaScript asset.Winter\Storm\Parse\Assetic\Filter\JavascriptImporterprocesses=include/=requiredirectives found in comment blocks of JavaScript assets passed throughSystem\Classes\CombineAssets. The directive target was resolved relative to the including file's own directory withrealpath()and inlined into the combined output with no confinement check, so a directive such as=include ../../../.envescaped the theme's asset tree and inlined an arbitrary server-readable file. The only restriction was that the target had to have a file extension, since extension-less names had.jsappended to them.Because the combined output is served through the
combine/{file}route, which performs no authentication or authorization checks, the disclosed contents then became readable by unauthenticated visitors at a stable URL as soon as the asset was referenced by any template.The leaked content includes any file the web process can read, most importantly the application
.envfile (disclosingAPP_KEYand database credentials). Text files were disclosed intact; binary content was mangled by the minification pipeline.This is the JavaScript-importer counterpart of GHSA-58fp-mcx6-7qf9 (Local File Inclusion through LESS
@importdirectives) and of CVE-2023-52085 / GHSA-2x7r-93ww-cxrq — the same vulnerability class reached through a different asset combiner filter.To actively exploit this issue, an attacker would need an authenticated backend account with the
cms.manage_assetspermission. By default this permission is assigned to the built-in Developer role. The Winter CMS maintainers strongly recommend that thecms.manage_assetspermission only be reserved to trusted administrators and developers in general, as it grants direct write access to files that are combined and served publicly.Patches
JavascriptImporterin Winter Storm now applies two independent gates to every=include/=requiretarget:.jstargets may be inlined. Any other extension is rejected before path resolution, which neutralises disclosure of non-JavaScript server files such as.env,.php, and.log. Extension-less includes are unaffected, as they are resolved to.jsbefore this check, exactly as before.PathResolver::withinAny()helper. A rejected include emits a comment in place of the file contents (or throws, if the directive was=require).The allowed-roots configuration is now shared between the JavaScript importer and the LESS compiler through a
HasAllowedImportRootstrait, andSystem\Classes\CombineAssetsconfigures both — along with the CSS@importfilter, using the import validator added inassetic/frameworkv3.2.1 — withthemes_path(),plugins_path(), andbase_path('modules')as the allowed roots. This preserves the cross-tree imports that shipped themes and plugins legitimately use (e.g. a plugin asset importing a module asset) while confining everything else.The backend permission descriptions for
cms.manage_assetsandcms.manage_contentnow also carry the same "should only be given to trusted users" warning that was already displayed forcms.manage_pages,cms.manage_layouts, andcms.manage_partials.This security issue has been fixed in v1.2.13 (Winter core) and v1.2.13 (Winter Storm).
Workarounds
If you cannot upgrade, apply wintercms/storm@fd673f4 and wintercms/winter@e09c8d3 manually. As an interim mitigation, remove the
cms.manage_assetspermission from any role that is not held by a fully trusted administrator or developer, and audit existing theme.jsassets for=include/=requiredirectives that resolve outside the theme's own asset directory.References
@importcounterpart of this issue, which shares the same root cause and hardening approach.Credit to Zyad Mohamed Elmahy (@elmahy111) for reporting the issue.
For more information
If you have any questions or comments about this advisory:
References