Listen to this Post
How the CVE works:
CVE-2024-2792 exploits an Insecure Direct Object Reference (IDOR) vulnerability in Grav CMS’s form plugin, specifically in the display field Twig template. Low-privilege users with page editing rights can inject malicious Frontmatter YAML when creating a page with the “Form” template. By accessing the “Expert” mode, they define a form with a display field that uses the ‘file’ parameter to reference arbitrary server paths. The vulnerable file, /user/plugins/form/templates/forms/fields/display/display.html.twig, lacks input sanitization and permission checks, allowing it to read and display any file content. This includes sensitive files like /grav/user/accounts/.yaml, which store hashed passwords, 2FA secrets, and reset tokens. The system does not verify if the user is authorized to access these files, enabling unauthorized file reads. This leads to account compromise via password cracking or token theft, and full server file disclosure. The flaw requires only page creation privileges, common for low-level users, making it critical for privilege escalation and system takeover.
Platform: Grav CMS
Version: 1.7.46
Vulnerability: File Read
Severity: Critical
Date: 2024-03-19
Prediction: Patch expected soon
What Undercode Say:
Analytics:
- Bash: find / -name “display.html.twig”
- Bash: grep -r “file” /user/plugins/form/templates/
- Code: {{ include(form.field.file) }}
- Code: form: fields: display: type: display file: /etc/passwd
How Exploit:
- Login with edit privileges.
- Create Form page.
- Inject Frontmatter payload.
- View page file content.
Protection from this CVE
- Update to patched version.
- Restrict page editing.
- Sanitize Frontmatter input.
- Implement access controls.
Impact:
- Account takeover.
- Arbitrary file read.
- Privilege escalation.
- System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
