fkie_cve-2024-28118

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a fix for this issue.

GHSA-r6vw-8v8r-pmp4 — Server Side Template Injection (SSTI)

Affected: Packagist: getgrav/grav

### Summary Due to the unrestricted access to twig extension class from grav context, an attacker can redefine config variable. As a result, attacker can bypass previous patch.

### Details The twig context has a function declared called getFunction. ```php public function getFunction($name) { if (!$this->extensionInitialized) { $this->initExtensions(); }

if (isset($this->functions[$name])) { return $this->functions[$name]; }

foreach ($this->functions as $pattern => $function) { $pattern = str_replace('\\*', '(.*?)', preg_quote($pattern, '#'), $count);

if ($count) { if (preg_match('#^'.$pattern.'$#', $name, $matches)) { array_shift($matches); $function->setArguments($matches);

return $function; } } }

foreach ($this->functionCallbacks as $callback) { if (false !== $function = \call_user_func($callback, $name)) { return $function; } }

return false; } ``` This function, if the value of `$name` does not exist in `$this->functions`, uses call_user_func to execute callback functions stored in `$this->functionCallbacks`.

It is possible to register arbitrary function using registerUndefinedFunctionCallback, but a callback that has already been registered exists and new callbacks added will not be executed.

T…

Most recent entries from all

EUVD-2026-4454

fkie_cve-2024-28118

GHSA-r6vw-8v8r-pmp4 — Server Side Template Injection (SSTI)

gsd-2024-28118