Vulnerability · Published Apr 13, 2021 · Assigned by GitHub_M

CVE-2021-29440Twig allowing dangerous PHP functions by default

High 8.4

In plain English

A high-severity code injection in grav from getgrav. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 29.9% (higher than 98% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.4High

Exploit odds (30 days)29.9%top 1.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling1Public PoC

Official description

Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getgrav/grav	1.7.11	GHSA-g8r4-p96j-xfxc

Affected products (as reported)

Vendor	Product	Versions
getgrav	grav	< 1.7.11

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

References

https://github.com/getgrav/grav/security/advisories/GHSA-g8r4-p96j-xfxc x_refsource_CONFIRM
https://packagist.org/packages/getgrav/grav x_refsource_MISC
http://packetstormsecurity.com/files/162987/Grav-CMS-1.7.10-Server-Side-Template-Injection.html x_refsource_MISC
https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities x_refsource_MISC