CVE-2024-45398: Contao CMS RCE Vulnerability

CVE-2024-45398 Overview

CVE-2024-45398 is an unrestricted file upload vulnerability in Contao, an open source content management system (CMS). A back end user with access to the file manager can upload malicious files and execute them on the server. The flaw is tracked under CWE-434 (Unrestricted Upload of File with Dangerous Type) and enables remote code execution against affected Contao installations. Fixed releases are 4.13.49, 5.3.15, and 5.4.3.

Critical Impact
Authenticated back end users can upload executable scripts through the file manager and trigger their execution, achieving remote code execution on the underlying web server.

Affected Products

Contao CMS versions prior to 4.13.49
Contao CMS 5.3.x versions prior to 5.3.15
Contao CMS 5.4.x versions prior to 5.4.3

Discovery Timeline

2024-09-17 - CVE-2024-45398 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-45398

Vulnerability Analysis

The vulnerability resides in the Contao back end file manager. Contao does not sufficiently restrict which file types authenticated users can upload into directories served by the web server. An attacker with back end access and file manager permissions can upload a PHP script or another interpretable file into the Contao upload directory. Because the web server is configured by default to execute PHP within the document root, a subsequent HTTP request to the uploaded file causes the server to execute attacker-controlled code.

Successful exploitation grants code execution in the context of the web server user. From this position, attackers can read application secrets, pivot to the database, tamper with content, and stage further intrusion activity against connected systems.

Root Cause

The root cause is missing enforcement of a file type allowlist and missing execution controls on the upload target directory. The application accepts files whose extensions or MIME types map to server-side interpreters, and the web server treats the resulting files as executable content rather than static assets.

Attack Vector

Exploitation requires network access to the Contao back end and valid credentials with file manager privileges. The attack chain consists of authenticating to the back end, uploading a script file through the file manager, and issuing a direct HTTP request to the uploaded resource to trigger execution. No user interaction is required beyond the attacker's own session. See the Contao Security Advisory and GitHub Security Advisory GHSA-vm6r-j788-hjh5 for vendor detail.

Detection Methods for CVE-2024-45398

Indicators of Compromise

Unexpected files with executable extensions such as .php, .phtml, .phar, or .pl appearing under the Contao files/ upload directory.
Web server access log entries showing direct GET or POST requests to files located inside the Contao upload directory.
Outbound network connections from the PHP-FPM or web server process to unfamiliar external hosts shortly after a file upload event.
New back end user accounts, unusual login sources, or elevated session activity for existing file manager users.

Detection Strategies

Monitor file integrity in the Contao upload directory and alert on the creation of any file with a server-executable extension.
Correlate back end authentication events with file upload actions and subsequent HTTP requests to uploaded paths.
Inspect web server logs for requests to .php files under user upload paths, which should never occur in a hardened deployment.

Monitoring Recommendations

Enable audit logging in Contao and forward back end user actions to a centralized logging or SIEM platform.
Alert on process execution events where the web server user spawns shell interpreters, curl, wget, or scripting binaries.
Track outbound egress from the web server host and flag connections to previously unseen destinations.

How to Mitigate CVE-2024-45398

Immediate Actions Required

Upgrade Contao to 4.13.49, 5.3.15, or 5.4.3 depending on the branch in use.
Audit back end user accounts and revoke file manager permissions from users who do not require them.
Review the Contao files/ directory for recently uploaded scripts and remove any unauthorized content.
Rotate credentials, API tokens, and database passwords stored on any host that may have been reached.

Patch Information

Contao released patched versions 4.13.49, 5.3.15, and 5.4.3 that address the unrestricted upload issue. Refer to the Contao Security Advisory and GitHub Security Advisory GHSA-vm6r-j788-hjh5 for release notes and upgrade guidance.

Workarounds

Configure the web server so PHP and other scripting interpreters do not execute files within the Contao upload directory.
On Apache, place an .htaccess file in the upload directory that disables PHP handlers and denies execution of dynamic content.
On Nginx, add a location block that returns static content only and prevents fastcgi_pass handling under the upload path.
Restrict back end access to the Contao administration interface using network controls such as VPN, IP allowlists, or a web application firewall.

bash

# Nginx configuration example: prevent script execution in the Contao upload directory
location ^~ /files/ {
    location ~* \.(php|phtml|phar|pl|py|cgi)$ {
        deny all;
        return 403;
    }
}