Log in Start free

Vulnerability · Published Jun 14, 2023 · Assigned by GitHub_M

CVE-2023-34253Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

High 8.8

In plain English

A high-severity security flaw in grav from getgrav. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.1% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)2.1%top 18.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistgetgrav/grav1.7.42GHSA-j3v8-v77f-fvgm

Affected products (as reported)

VendorProductVersions
getgrav grav < 1.7.42

Weakness: CWE-184, CWE-1336 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References