CVE-2024-28118: Server Side Template Injection (SSTI) in getgrav/grav
Summary
CVE-2024-28118: Server Side Template Injection (SSTI). Affects getgrav/grav versions < 1.7.45. Fixed in 1.7.45. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
getgrav/grav is an open-source flat-file CMS written in PHP. It allows users to create and manage websites using a file-based approach instead of a traditional database. The package utilizes the Twig templating engine for rendering dynamic content. However, a vulnerability in the Twig context of getgrav/grav allows an attacker to redefine a config variable, bypassing a previous patch.
Vulnerability Detail
The vulnerability arises due to unrestricted access to the twig extension class from the grav context. This allows an attacker to redefine the config variable, which can have severe consequences. The Twig context has a function called getFunction, which, if the value of $name does not exist in $this->functions, executes callback functions stored in $this->functionCallbacks using call_user_func. By registering an arbitrary function using registerUndefinedFunctionCallback, an attacker can execute any arbitrarily registered callback function. The default function callback can be manipulated to set the value of system.twig.undefined_functions to false, enabling the execution of the attacker's registered callback function. This vulnerability can be exploited by any administrative user allowed to create or edit pages with enabled Twig processing of static pages, potentially leading to arbitrary code execution and privilege escalation.
How To Fix
Minimum fixed version
1.7.45
This is the first release that contains the fix.
composer require getgrav/grav:1.7.45Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update getgrav/grav to the latest version to fix the issue.
Conclusion
The vulnerability in getgrav/grav allows an attacker to redefine a config variable, potentially leading to arbitrary code execution and privilege escalation. It is crucial to update getgrav/grav to version 1.7.45 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getgrav/grav →
FAQ
getgrav/grav is an open-source flat-file CMS written in PHP that allows users to create and manage websites using a file-based approach instead of a traditional database.
Server Side Template Injection (SSTI) is a vulnerability that allows an attacker to inject and execute arbitrary code in server-side templates, leading to potential code execution and privilege escalation.
The vulnerability in getgrav/grav allows an attacker to redefine a config variable, potentially leading to arbitrary code execution and privilege escalation. This can be exploited by any administrative user allowed to create or edit pages with enabled Twig processing of static pages.
Yes, a fix is available for this vulnerability. It is recommended to update getgrav/grav to version 1.7.45 or later to mitigate the issue.
No, there are no known workarounds for this vulnerability. Updating getgrav/grav to the latest version is the recommended solution.
References
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
