CVE-2026-103475 in yii2-starter-kit
Summary
by MITRE • 09/30/2026
yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default development configuration. Unauthenticated remote attackers can access the debug endpoint to read sensitive data including session cookies and database queries, or access the Gii endpoint to generate and write PHP files into the application directory.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability identified in yii2-starter-kit versions through 4.2.0 stems from a critical misconfiguration of development tools that are inadvertently exposed to public networks. Specifically, the Yii debug module and the Gii code generator module, which are intended for local development use only, have their access control lists configured with allowedIPs set to ['*']. This wildcard configuration effectively disables IP-based restrictions, allowing any remote host on the internet to interact with these sensitive administrative interfaces without authentication or network-level filtering.
The exposure of the Yii debug module allows unauthenticated attackers to inspect detailed application runtime information that is typically restricted to local developers. By accessing this endpoint, an attacker can view session cookies, which may contain sensitive identifiers or tokens if not properly secured at a higher level. Furthermore, the debug toolbar provides visibility into database queries executed by the application, potentially revealing schema structures, table names, and even data contents depending on the query parameters used during normal operation. This information disclosure significantly aids an attacker in mapping the internal architecture of the web application and identifying potential secondary vulnerabilities such as SQL injection or insecure direct object references.
More critically, the exposure of the Gii module presents a severe risk of remote code execution. The Gii tool is designed to generate PHP code based on user input regarding database schemas or model structures. When accessible from an untrusted network, attackers can utilize this feature to craft and write arbitrary PHP files directly into the application directory. This capability allows for the deployment of web shells or other malicious scripts that provide persistent backdoor access to the server. Once a file is written via Gii, it can be executed by the web server, granting the attacker full control over the underlying system environment, including the ability to read, modify, and delete files, as well as execute arbitrary commands with the privileges of the web service account.
From a classification perspective, this vulnerability aligns with CWE-200: Information Exposure and CWE-436: Interpretation Conflict, specifically regarding the misinterpretation of development configurations in production-like or publicly accessible environments. In terms of offensive security frameworks, this scenario maps to MITRE ATT&CK technique T1505.003: Web Shell, as Gii can be abused to deploy web shells, and T1078: Valid Accounts if session cookies are harvested for further authentication bypasses. The root cause is a failure in secure configuration management where development-specific settings were not isolated from production or external-facing deployments.
To mitigate this vulnerability, it is imperative to restrict access to the Yii debug and Gii modules exclusively to trusted local IP addresses, such as 127.0.0.1 for localhost testing. Developers should ensure that these modules are disabled entirely in any environment intended for public access. Additionally, implementing strict network segmentation or using reverse proxies with explicit allow-lists can provide an additional layer of defense. Regular security audits and configuration reviews must be conducted to prevent the accidental deployment of development tools in production environments, ensuring that sensitive debugging interfaces remain inaccessible to unauthenticated remote users.