PT-2023-24777 · Grav · Grav

Jacobsoo · Published 2023-06-14 · Updated 2023-06-23 · CVE-2023-34253

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.42

Description The issue concerns a flat-file content management system where the denylist, introduced to prevent the execution of dangerous functions via malicious template injection, was insufficient. This allowed a low-privileged attacker with login access to the Grav Admin panel and page creation/update permissions to inject malicious templates, potentially leading to remote code execution. The denylist could be subverted in multiple ways, including using unsafe functions not banned, using capitalized callable names, and using fully-qualified names for referencing callables.

Recommendations For versions prior to 1.7.42, update to version 1.7.42 to improve the denylist and prevent the execution of dangerous functions via malicious template injection.

Exploit

Fix

RCE

Incomplete List of Disallowed Inputs

Code Injection

Weakness Enumeration

CWE-184

CWE-1336

CWE-94

Related Identifiers

CVE-2023-34253

GHSA-J3V8-V77F-FVGM

Affected Products

Grav

References · 13

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34253.json · Exploit
• 🔥 https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66 · Exploit
• https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-34253 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34253 · Vendor Advisory
• https://github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83 · Patch
• https://osv.dev/vulnerability/GHSA-j3v8-v77f-fvgm · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190 · Note
• https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8 · Note
• https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5 · Note
• https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec · Note