CVE-2023-34448: Grav Server-side Template Injection (SSTI) via Twig Default Filters
Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter() function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig map() and reduce() filter functions in system/src/Grav/Common/Twig/Extension/GravExtension.php to validate the argument passed to the filter in $arrow.
Other sources
Grav Server-side Template Injection (SSTI) via Twig Default Filters
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/getgrav/gravto a version that resolves this vulnerability.Fixed in 1.7.42 - Upgrade
Upgrade
getgrav/gravto a version that resolves this vulnerability.Fixed in 1.74.2 - Configuration
In the Admin page editor, click Preview, then Advanced, and ensure the checkbox beside Twig is selected so Twig processing is enabled for the modified webpage.
Grav Admin - Twig processing for modified webpage Twig processing enabled (Advanced tab -> Twig checkbox) = ensure enabled - Operational
After applying the fix, log out of Grav Admin and log back in using the account created in step 2 (to ensure the changes apply under a session with the intended permissions).
Event History
Frequently Asked Questions
What is CVE-2023-34448?
CVE-2023-34448 is a server-side template injection vulnerability in Grav prior to version 1.7.42 that can be exploited using the default `filter()` function.
How severe is CVE-2023-34448?
CVE-2023-34448 has a severity rating of 7.2, which is considered high.
What software is affected by CVE-2023-34448?
Grav prior to version 1.7.42 is affected by CVE-2023-34448.
How can CVE-2023-34448 be exploited?
CVE-2023-34448 can be exploited by leveraging the default `filter()` function in Grav to perform server-side template injection.
Is there a patch available for CVE-2023-34448?
Yes, a patch for CVE-2023-34448 is available in version 1.7.42 of Grav.