1. Home
  2. Web App Vulnerabilities
  3. How to remediate – CraftCMS DevMode Enabled
Searching...

How to remediate – CraftCMS DevMode Enabled

Contents

1. Introduction

CraftCMS DevMode Enabled refers to a configuration issue where CraftCMS is running in development mode. This can expose sensitive information about your web application, potentially aiding attackers in identifying vulnerabilities and gaining unauthorized access. Systems affected are typically those running the CraftCMS content management system. A likely impact on confidentiality is high due to potential data leakage; integrity could be compromised if an attacker modifies code or configuration; availability may also be impacted through denial of service attacks exploiting exposed information.

2. Technical Explanation

CraftCMS DevMode (devMode) provides detailed debugging information and disables certain security features for faster development. When enabled, it can leak file paths, database connection details, and other sensitive data to anyone accessing the application. An attacker could use this information to identify vulnerabilities in CraftCMS or its plugins, potentially leading to remote code execution or data breaches. The vulnerability exists when devMode is active in a production environment.

  • Root cause: The devMode configuration setting is enabled in the general.php file.
  • Exploit mechanism: An attacker simply accesses the application while devMode is enabled, allowing them to view debugging information and potentially identify vulnerabilities. For example, accessing a page with an error could reveal database credentials or internal file paths.
  • Scope: CraftCMS versions 3 and 4 are affected when running in development mode.

3. Detection and Assessment

You can confirm if a system is vulnerable by checking the CraftCMS configuration and looking for debugging information in application responses.

  • Quick checks: Check the general.php file in your CraftCMS installation directory for the line 'devMode' => true,.
  • Scanning: Nessus plugin ID 16739 can detect this vulnerability. This is an example only and may require updates.
  • Logs and evidence: Look for debugging information or error messages in application logs that reveal internal file paths or database details. The location of these logs varies depending on your CraftCMS configuration, but typically resides within the storage/logs directory.
grep -r "devMode" /path/to/craftcms/config/general.php

4. Solution / Remediation Steps

Disable CraftCMS development mode to remove sensitive information leakage.

4.1 Preparation

  • Back up your general.php file before making any changes. Stopping services is not usually required for this change, but a snapshot of the server is recommended.
  • Ensure you have access to modify the CraftCMS configuration files. Roll back by restoring the original general.php file if necessary.
  • A standard change window may be appropriate depending on your organisation’s policies. Approval from a system administrator might be required.

4.2 Implementation

  1. Step 1: Open the general.php configuration file in a text editor.
  2. Step 2: Locate the line containing 'devMode' => true,.
  3. Step 3: Change true to false. The line should now read 'devMode' => false,.
  4. Step 4: Save the changes to the general.php file.

4.3 Config or Code Example

Before

 true,
];
?>

After

 false,
];
?>

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue.

  • Least privilege: Ensure that only authorized personnel have access to modify CraftCMS configuration files.
  • Secure defaults: Configure CraftCMS with secure settings by default, disabling development mode in production environments.
  • Configuration management: Implement a robust configuration management process to track and control changes to critical system configurations.

4.5 Automation (Optional)

Automation is not generally recommended for this specific change due to the potential impact of incorrect configuration. However, you could use a script to check the value of devMode during deployment and flag any production environments where it’s enabled.

#!/bin/bash
# Check if devMode is enabled in production environment
if grep -q "devMode' => true" /path/to/craftcms/config/general.php; then
  echo "WARNING: DevMode is enabled in production!"
fi

5. Verification / Validation

Confirm the fix by checking the CraftCMS configuration and verifying that debugging information is no longer exposed.

  • Post-fix check: Run grep -r "devMode" /path/to/craftcms/config/general.php, expecting no output or a line showing 'devMode' => false,.
  • Re-test: Access the application and attempt to trigger an error message. Verify that debugging information is not displayed in the response.
  • Monitoring: Monitor application logs for unexpected errors or changes in behavior that might indicate a regression.
grep -r "devMode" /path/to/craftcms/config/general.php

6. Preventive Measures and Monitoring

Implement security baselines and automated checks to prevent this issue from recurring.

  • Baselines: Update your CraftCMS security baseline to include a requirement for disabling devMode in production environments.
  • Pipelines: Add a check in your CI/CD pipeline to verify that devMode is set to false before deploying to production.
  • Asset and patch process: Regularly review the configuration of CraftCMS instances to ensure compliance with security policies.

7. Risks, Side Effects, and Roll Back

Disabling devMode may hide debugging information that is useful for troubleshooting. However, this is a minor inconvenience compared to the risk of exposing sensitive data.

  • Risk or side effect 1: Reduced debugging visibility in production environments. Mitigation: Enable logging and use external monitoring tools for troubleshooting.
  • Roll back: Restore the original general.php file if necessary, reverting the change to enable devMode.

8. References and Resources

Updated on December 27, 2025

Was this article helpful?

Yes No

Related Articles