CVE-2024-34082: Grav Arbitrary File Read to Account Takeover

First published: Wed May 15 2024(Updated: )

### Summary A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. ### Proof Of Concept `{{ read_file('/var/www/html/grav/user/accounts/riri.yaml') }}` Use the above Twig template syntax in a page and observe that the administrator riri's authentication details are exposed accessible by any unauthenticated user.  As an additional proof of concept for reading system files, observe the `/etc/passwd` file read using the following Twig syntax: `{{ read_file('/etc/passwd') }}`  ### Impact This can allow a low privileged user to perform a full account takeover of other registered users including Adminsitrators. This can also allow an adversary to read any file in the web server.

Credit: security-advisories@github.com security-advisories@github.com

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/title
• agent/type
• agent/first-publish-date
• agent/weakness
• agent/description
• agent/event
• collector/github-advisory-latest
• source/GitHub
• alias/GHSA-f8v5-jmfh-pr69
• alias/CVE-2024-34082
• agent/software-canonical-lookup
• agent/references
• collector/nvd-cve
• source/NVD
• agent/author
• collector/github-advisory
• collector/mitre-cve
• source/MITRE
• agent/trending
• collector/nvd-api
• agent/severity
• agent/remedy
• agent/last-modified-date
• agent/softwarecombine
• agent/tags
• package-manager/composer
• vendor/getgrav
• canonical/getgrav grav