PT-2023-24883 · Twig+1 · Twig+1

Jacobsoo · Published 2023-06-14 · Updated 2023-06-22 · CVE-2023-34448

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.42

Description The issue concerns a server-side template injection vulnerability leveraging the default filter() function. This allows for remote code execution by invoking arbitrary unsafe functions through other built-in functions exposed by Twig's Core Extension. The estimated number of potentially affected devices worldwide is not specified. Details about real-world incidents where this issue was exploited are not provided. Technical details include the use of Twig's Core Extension and its built-in functions such as map() and reduce(). The filter() function and variables like $arrow are involved in the vulnerability.

Recommendations For versions prior to 1.7.42, update to version 1.7.42 or later, which includes a patch that overrides the built-in Twig map() and reduce() filter functions to validate the argument passed to the filter in $arrow.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-20

CWE-1336

CWE-94

Related Identifiers

CVE-2023-34448

GHSA-WHR7-M3F8-MPM8

Affected Products

Grav

Twig

References · 14

• 🔥 https://github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34448.json · Exploit
• 🔥 https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66 · Exploit
• https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8 · Vendor Advisory
• https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8 · Vendor Advisory
• https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34448 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34448 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-whr7-m3f8-mpm8 · Vendor Advisory
• https://github.com/getgrav/grav · Note
• https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b · Note
• https://github.com/getgrav/grav/commit/9d01140a63c77075ef09b26ef57cf186138151a5 · Note
• https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec · Note
• https://t.me/cvenotify/52365 · Telegram Post