CVE-2020-12790: 
PHP vulnerability analysis and mitigation

The SEOmatic plugin before version 3.2.49 for Craft CMS contained a Server-Side Template Injection (SSTI) vulnerability (CVE-2020-12790). The vulnerability was discovered in the helpers/DynamicMeta.php file where improper URL sanitization could lead to template injection and credentials disclosure. The issue was disclosed on March 23, 2020, and affected all versions of the plugin prior to 3.2.49 (ISEC Report).

The vulnerability existed due to insufficient sanitization in the helpers/DynamicMeta.php file, where an attacker could inject a Twig template through a URL-part following a semicolon. The injected Twig template would then be rendered in the server response, allowing for Server-Side Template Injection. By leveraging Craft CMS built-in methods, attackers could read information from configuration files, including sensitive database credentials through expressions like craft.config.get('password','db') and craft.config.get('user','db') (ISEC Report).

The vulnerability allowed attackers to access sensitive information from the application, including database credentials. Through the exploitation of the SSTI vulnerability, attackers could leverage Craft CMS built-in methods to read configuration files and extract sensitive data (ISEC Report).

The vulnerability could be exploited by injecting a Twig template through a URL-part after a semicolon. A proof of concept demonstration was provided by the security researchers who discovered the issue (ISEC Report).

The vulnerability was patched in SEOmatic version 3.2.49, released on March 24, 2020. The fix ensures that URLs are properly urldecoded before attempting to use a RegEx to strip tags from them (GitHub Release). Users should upgrade to version 3.2.49 or later to protect against this vulnerability.