# RCA Report: GHSA-v64r-7wg9-23pr

## Summary

Unauthenticated users can trigger database backup operations in Craft CMS via specific admin controller actions that are explicitly configured with anonymous access flags. This vulnerability allows attackers to cause resource exhaustion (disk space, CPU) through repeated backup requests or potentially gain access to sensitive database information if combined with other vulnerabilities.

## Impact

- **Package/Component:** craftcms/cms - Admin Controllers (AppController, BaseUpdaterController)
- **Affected Versions:** >= 5.0.0-RC1, <= 5.8.20 and >= 3.0.0, <= 4.16.16
- **Risk Level:** HIGH - Unauthenticated DoS and potential information disclosure
- **Consequences:**
  - Disk space exhaustion through repeated backup creation
  - CPU/IO resource consumption during backup operations
  - Potential sensitive data exposure if backup files are accessible

## Root Cause

The vulnerability exists because certain admin controller actions are explicitly configured to allow anonymous (unauthenticated) access:

```php
// AppController.php
protected array|bool|int $allowAnonymous = [
    'migrate' => self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE,
    // ...
];

// BaseUpdaterController.php
protected array|bool|int $allowAnonymous = self::ALLOW_ANONYMOUS_LIVE | self::ALLOW_ANONYMOUS_OFFLINE;
```

When `backupOnUpdate` is enabled in the Craft configuration (which is the default), these endpoints trigger `Craft::$app->getDb()->backup()`, creating a database backup file.

**Fix Commit:** [f83d4e0c6b906743206b4747db4abf8164b8da39](https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39)

## Reproduction Steps

1. Reference to `repro/reproduction_steps.sh` which automates the full reproduction
2. The script:
   - Sets up a Craft CMS 5.8.19 installation with PostgreSQL
   - Configures `backupOnUpdate => true` (default behavior)
   - Attempts unauthenticated POST to `/admin/actions/app/migrate`
   - Attempts the updater flow: `/admin/actions/updater/index` → `/admin/actions/updater/backup`
3. Expected evidence: Database backup file created in `storage/backups/` or `dbBackupPath` in HTTP response

## Evidence

- **Log Files:**
  - `logs/run-*.log` - Main execution log
  - `logs/curl-*.log` - HTTP request/response traces
  - `logs/php-server-*.log` - PHP built-in server logs
- **Key Excerpts:**
  - Response includes `dbBackupPath` pointing to `storage/backups/<name>.sql`
  - Backup files appear in the `storage/backups/` directory
- **Environment:** Craft CMS 5.8.19, PHP 8.2, PostgreSQL

## Recommendations / Next Steps

1. **Immediate Fix:** Update to Craft CMS 5.8.21 or 4.16.17
2. **Mitigation:** If update not possible immediately:
   - Set `backupOnUpdate => false` in `config/general.php`
   - Restrict access to `/admin/actions/*` endpoints at web server level
3. **Testing:** After update, verify:
   - Anonymous POST to `/admin/actions/app/migrate` returns 401/403
   - Anonymous POST to `/admin/actions/updater/backup` returns 401/403

## Additional Notes

- **Idempotency:** The reproduction script is idempotent - running it multiple times produces consistent results
- **Limitations:** The reproduction requires network access to install Craft CMS via Composer
- **Edge Cases:** The vulnerability requires `backupOnUpdate` to be enabled (default), installations with this disabled are not affected

## References

- [GHSA-v64r-7wg9-23pr](https://github.com/craftcms/cms/security/advisories/GHSA-v64r-7wg9-23pr)
- [CVE-2025-68456](https://nvd.nist.gov/vuln/detail/CVE-2025-68456)
- [Fix Commit](https://github.com/craftcms/cms/commit/f83d4e0c6b906743206b4747db4abf8164b8da39)
- [Changelog 5.8.21](https://github.com/craftcms/cms/blob/5.x/CHANGELOG.md#5821---2025-12-04)