DebugKit provides a debugging toolbar for CakePHP applications. Prior to 4.10.3 and 5.2.4, the DebugKit MailPreview feature in src/Controller/MailPreviewController.php accepts a route-controlled previewName value in findPreview and passes the resolved class from App::className() to constructor execution without rejecting namespace separators or verifying that the class extends DebugKit\Mailer\MailPreview. An attacker able to access DebugKit while debug mode is enabled and the request hostname is local or allowlisted can select an unintended application class through the mail-preview preview route, resulting in arbitrary constructor execution and limited disclosure of application information.
This issue is fixed in versions 4.10.3 and 5.2.4.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
Low
Partial data leak
Integrity
None
No data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
References 6
https://github.com/cakephp/debug_kit/commit/7c4d85e984c2334b0f50cd02578a927ff96…
security-advisories@github.com
https://github.com/cakephp/debug_kit/commit/c8a2a9e07d56a5e212d95f6947f370f3b5e…
security-advisories@github.com
https://github.com/cakephp/debug_kit/pull/1078
security-advisories@github.com
https://github.com/cakephp/debug_kit/releases/tag/4.10.3
security-advisories@github.com
https://github.com/cakephp/debug_kit/releases/tag/5.2.4
security-advisories@github.com
https://github.com/cakephp/debug_kit/security/advisories/GHSA-p46m-g734-vpc4
security-advisories@github.com