Kirby Arbitrary Method Call Vulnerability via REST API Endpoints

A vulnerability allowing arbitrary method calls has been identified in Kirby, an open-source content management system. This issue affects Kirby versions 4.0.0 through 4.9.0 and 5.0.0 through 5.4.0. The vulnerability arises because the application did not properly validate model attributes used in collection queries. As a result, authenticated users could exploit this flaw to invoke arbitrary model methods through the REST API, potentially leading to the disclosure of sensitive information or unauthorized actions. Methods that could be called include password() and root(), which reveal the password hash and absolute filesystem path, respectively, as well as loginPasswordless(), which could escalate privileges to another user, and delete(), which could remove all queried models if the user had the necessary permissions.

Impact

Exploitation of this vulnerability allows authenticated users to invoke arbitrary model methods via the REST API, leading to unauthorized access to sensitive information or execution of unintended actions. This includes disclosing password hashes, absolute filesystem paths, and escalating privileges to other users.

Remediation

Users are advised to upgrade to Kirby versions 4.9.1 or 5.4.1, both of which address this vulnerability by validating model attributes in collection queries and restricting access to sensitive methods. Instructions for downloading these versions are available on the Kirby GitHub releases page.