CVE-2024-4990

The base Component class in yiisoft/yii2 2.0.48 (CWE-470, unsafe reflection) has a flaw in the __set() magic method: it does not validate that an assigned value is a valid Behavior class name or configuration, allowing attackers to instantiate arbitrary classes. An attacker triggers it by sending attacker-controlled data that the application passes into Component property assignment, supplying chosen class names whose constructors receive parameters and whose setter methods are invoked. Depending on the dependencies installed in the application, this can lead to execution of arbitrary code, retrieval of sensitive information, or unauthorized access; the flaw is network-exploitable with no privileges or user interaction required (CVSS 3.1: 9.1 critical). Any PHP application or CMS built on the Yii 2 framework running the affected version is exposed. A public proof-of-concept is available via huntr, the issue is not yet in CISA KEV, and EPSS assigns an 80.2% probability of exploitation within 30 days (100th percentile); related headlines report exploitation of flaws in Craft CMS, a Yii-based application, indicating the ecosystem is actively targeted.

What to do: Upgrade yiisoft/yii2 to a release newer than 2.0.48 (the flaw was addressed in 2.0.49) and rebuild/deploy dependent applications. Audit application code for user-controlled input that flows into Component property assignment or __set(), and validate/whitelist class names there. Operators of Yii-based products such as Craft CMS should verify their framework version and apply vendor-supplied updates promptly, given the high EPSS score.