fkie_cve-2024-28116

Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.

GHSA-c9gp-64c4-2rrh — Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

Affected: Packagist: getgrav/grav

### Summary Grav CMS is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox.

### Details The Grav CMS implements a custom sandbox to protect the powerful Twig methods "registerUndefinedFunctionCallback()" and "registerUndefinedFilterCallback()", in order to avoid SSTI attacks by denying the calling of dangerous PHP functions into the Twig template directives (such as: "exec()", "passthru()", "system()", etc.). The current defenses are based on a blacklist of prohibited functions (PHP, Twig), checked through the "isDangerousFunction()" method called in the file "system/src/Grav/Common/Twig.php":

```php ... $this->twig = new TwigEnvironment($loader_chain, $params);

$this->twig->registerUndefinedFunctionCallback(function (string $name) use ($config) { $allowed = $config->get('system.twig.safe_functions'); if (is_array($allowed) && in_array($name, $allowed, true) && function_exists($name)) { return new TwigFunction($name, $name); } if ($config->get('system.twig.undefined_functions')) { if (function_exists($name)) { if (!Utils::isDangerousFunction($name)) { user_error("PHP function {$name}() was used as Twig function. This is deprecated in Grav 1.7. Please add it to system configuration: `system.twig.safe_functions`", E_USER_DEPRECATED);

ret…

Most recent entries from all

bdu:2024-02464

EUVD-2026-4461

fkie_cve-2024-28116

GHSA-c9gp-64c4-2rrh — Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass

gsd-2024-28116