PT-2023-24776 · Grav · Grav

Jacobsoo · Published 2023-06-14 · Updated 2023-06-23 · CVE-2023-34252

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.42

Description Grav is a flat-file content management system with a logic flaw in the GravExtension.filterFilter() function. This flaw allows validation against a denylist of unsafe functions to be skipped when an array is passed as a callable argument, instead of a string. A low-privileged attacker with login access to the Grav Admin panel and page creation/update permissions can inject malicious templates to obtain remote code execution. The vulnerability is found in the GravExtension.filterFilter() function declared in /system/src/Grav/Common/Twig/Extension/GravExtension.php.

Recommendations For versions prior to 1.7.42, update to version 1.7.42 to resolve the issue. Additionally, ensure that twig.undefined functions and twig.undefined filters properties in the /path/to/webroot/system/config/system.yaml configuration file are set to false to disallow Twig from treating undefined filters/functions as PHP functions and executing them.

Exploit

Fix

RCE

Code Injection

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-1336

CWE-94

CWE-184

Related Identifiers

CVE-2023-34252

GHSA-96XV-RMWJ-6P9W

Affected Products

Grav

References · 13

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-96xv-rmwj-6p9w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34252.json · Exploit
• https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec · Patch
• https://osv.dev/vulnerability/GHSA-96xv-rmwj-6p9w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34252 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34252 · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1692-L1698 · Note
• https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1956-L2074 · Note
• https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b · Note
• https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5 · Note
• https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8 · Note
• https://t.me/cibsecurity/65247 · Telegram Post