PT-2024-22273 · Grav · Grav

As3617 + 1 · Published 2024-03-21 · Updated 2025-01-02 · CVE-2024-28118

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav versions prior to 1.7.45

Description The issue arises due to unrestricted access to the twig extension class from the Grav context, allowing an attacker to redefine config variables and bypass previous SSTI mitigation. This can lead to arbitrary code execution and privilege elevation on the instance. The Twig processor runs unsandboxed, and its processing of static pages can be enabled by any administrative user allowed to create or edit pages.

Recommendations For Grav versions prior to 1.7.45, update to version 1.7.45 or later to resolve the issue. As a temporary workaround, consider disabling the Twig processor for static pages or restricting access to the twig extension class to minimize the risk of exploitation. Avoid using the registerUndefinedFunctionCallback function until the issue is resolved.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-28118

GHSA-R6VW-8V8R-PMP4

Affected Products

Grav

References · 11

• 🔥 https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28118.json · Exploit
• https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe · Patch
• https://osv.dev/vulnerability/GHSA-r6vw-8v8r-pmp4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-28118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-28118 · Security Note
• https://github.com/getgrav/grav · Note
• https://twitter.com/VulmonFeeds/status/1770973881794265179 · Twitter Post
• https://twitter.com/CVEnew/status/1770937403601281176 · Twitter Post
• https://t.me/cvenotify/106105 · Telegram Post
• https://twitter.com/cracbot/status/1771321618159014004 · Twitter Post