Listen to this Post
In Grav CMS, users with admin panel access and permissions to create or edit pages can enable Twig processing in the page frontmatter by setting ‘process: twig: true’ in the advanced settings. This allows Twig expressions in page content to be executed during rendering. The Twig sandbox is not enforced, providing unrestricted access to internal PHP objects and methods within the system/src/Grav/Common directory. Attackers with ‘admin.pages’ access can inject malicious Twig code that calls Grav’s internal APIs. For privilege escalation, they use grav.user.update() to modify user access rights to admin or super admin, followed by grav.user.save() to persist changes. For remote code execution, they use grav.scheduler.addCommand() to schedule arbitrary system commands, grav.scheduler.save() to save them, and grav.scheduler.run() to execute. Exploitation requires visiting the page with the injected payload, triggering the code execution or privilege escalation. This vulnerability stems from improper access control and lack of sandboxing in Twig processing.
Platform: Grav CMS
Version: Prior versions
Vulnerability: PE and RCE
Severity: Critical
Date: 2023-10-01
Prediction: Patch expected soon
What Undercode Say:
{% set _ = grav.user.update({ ‘access’: { ‘admin’: { ‘login’: true, ‘super’: true } } }, {}) %}
{% set _ = grav.user.save() %}
{% set _ = grav.scheduler.addCommand(‘curl’, [‘http://localhost:8000’]) %}
{% set _ = grav.scheduler.save() %}
{% set _ = grav.scheduler.run() %}
how Exploit:
Enable Twig processing.
Inject payload.
Visit page.
Protection from this CVE
Disable Twig globally.
Restrict page edits.
Apply patches.
Impact:
Privilege escalation.
Remote code execution.
System compromise.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
