Pico 3.0.0-alpha.2 Exploit

Pico CMS (stable) has a good track record of flat-file security, but alpha versions are outside that guarantee. The project’s SECURITY.md file (if present) outlines reporting procedures. Historically, the maintainers respond to responsible disclosures but focus on stable releases.

The exploit in question allows an attacker to potentially gain unauthorized access or control over a device running the vulnerable firmware. Such exploits are critical because they can be used to compromise the security of devices, leading to data breaches, device hijacking, or other malicious activities.

In a secure Pico installation, Twig templates are sandboxed to prevent _self.env.registerUndefinedFilterCallback("exec") style attacks. However, in alpha.2, the allowed_functions blacklist was incomplete. Pico 3.0.0-alpha.2 Exploit

The Exploit Payload: An attacker submits a crafted HTTP POST request to the theme preview endpoint (which does not require authentication in alpha builds):

POST /?action=preview_theme HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
theme_template=shell&content=join 

Why this works:

Warning: The following is for educational and defensive purposes only.

An attacker can trigger the exploit with a single curl command. The goal is to inject a PHP web shell into the Twig cache file. Pico CMS (stable) has a good track record