PT-2024-22272 · Grav · Grav
As3617
+1
·
Published
2024-03-21
·
Updated
2025-01-02
·
CVE-2024-28117
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Grav versions prior to 1.7.45
Description
Grav is an open-source, flat-file content management system. The issue arises because Grav validates accessible functions through the
Utils::isDangerousFunction function but does not impose restrictions on twig functions like twig array map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.Recommendations
For Grav versions prior to 1.7.45, upgrade to the patched version 1.7.45 to mitigate this issue. As a temporary workaround, consider restricting access to the
twig array map function and disabling unsandboxed Twig processing for static pages until the patch is applied. Avoid using the call user func function in conjunction with twig array map to prevent arbitrary code execution.Exploit
Fix
Code Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Grav