CVE-2024-28119: Server Side Template Injection (SSTI) via Twig escape handler in getgrav/grav
Summary
CVE-2024-28119: Server Side Template Injection (SSTI) via Twig escape handler. Affects getgrav/grav versions < 1.7.45. Fixed in 1.7.45. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The getgrav/grav package is an open-source flat-file CMS (Content Management System) written in PHP. It allows users to create and manage websites using a file-based approach instead of a traditional database. The package utilizes the Twig templating engine for rendering dynamic content. Twig provides a setEscaper method that allows the definition of custom escape functions. However, due to unrestricted access to the twig extension class from the grav context, an attacker can redefine the escape function and execute arbitrary commands.
Vulnerability Detail
The vulnerability arises from the lack of validation for the $callable variable in the setEscaper method of the Twig extension class. By exploiting this, an attacker can redefine the escape function to execute arbitrary commands. This can lead to remote code execution and privilege escalation on the affected instance. An attacker with administrative privileges allowed to create or edit pages can enable Twig processing of static pages in the front matter, providing an avenue for exploitation.
How To Fix
Minimum fixed version
1.7.45
This is the first release that contains the fix.
composer require getgrav/grav:1.7.45Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable Twig processing of static pages in the front matter by removing or commenting out the relevant configuration. This can help mitigate the risk of exploitation until the package is updated to a secure version.
Conclusion
The Server Side Template Injection vulnerability in the getgrav/grav package allows an attacker to execute arbitrary commands and potentially gain remote code execution and privilege escalation. It is recommended to update the package to version 1.7.45 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getgrav/grav →
FAQ
The vulnerability allows an attacker to execute arbitrary commands, potentially leading to remote code execution and privilege escalation on the affected instance.
Users of the getgrav/grav package versions prior to 1.7.45 are affected by this vulnerability.
No, an attacker with administrative privileges allowed to create or edit pages can exploit this vulnerability.
There are no known instances of this vulnerability being exploited in the wild at the time of this report.
Yes, the CVSS score for this vulnerability is 7.2 (High severity).
References
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
