CodeIgniter4 Remote CLI Command Execution Vulnerability

A vulnerability in CodeIgniter4 versions prior to 4.1.9 allows for improper input validation, which can lead to the execution of Command Line Interface (CLI) routes through HTTP requests. This issue has been addressed in version 4.1.9, but no workarounds are available.

Impact

Exploitation of this vulnerability allows for remote execution of CLI commands via HTTP requests, potentially leading to unauthorized command execution on the server.

Reproduction

The vulnerability can be reproduced by sending an HTTP request to a CLI route while the server is configured to handle the request as a CLI command. This can be done by setting the 'REQUEST_METHOD' to 'CLI' and the 'REQUEST_URI' to the desired CLI route.

Remediation

Users are advised to upgrade to CodeIgniter4 version 4.1.9 or later.