Listen to this Post
The CVE-2021-12345 vulnerability works by exploiting a weakness in Grav CMS’s custom Twig sandbox. The sandbox uses a `registerUndefinedFilterCallback` function to intercept calls to undefined Twig filters. It checks if a requested function name is dangerous via isDangerousFunction(), blocking PHP functions like `system` and exec. However, an attacker can inject malicious Twig template code that accesses the Twig environment object (grav.twig). Through this object, they can directly modify the `system.twig.safe_filters` configuration array within the running Twig context, adding dangerous functions like `system` to the safe list. This bypasses the `isDangerousFunction()` check, allowing the subsequent use of `{{ ‘id’|system }}` to execute arbitrary OS commands on the server.
Platform: Grav CMS
Version: Prior to 1.7.0
Vulnerability : SSTI Bypass
Severity: Critical
date: 2023-10-15
Prediction: 2023-11-30
What Undercode Say:
Scanning for vulnerable versions
find /var/www -name "system.yaml" -exec grep -l "twig:" {} \;
curl -s http://target/grav-admin/ | grep "Grav v"
Post-exploitation reconnaissance
{{ 'ls -la /'|system }}
{{ 'cat /etc/passwd'|exec }}
How Exploit:
1. Authenticate as editor.
2. Edit page with Twig.
3. Inject payload to modify `safe_filters`.
4. Inject second payload to execute command.
5. Save and visit page.
Protection from this CVE
Update Grav CMS immediately. Restrict Twig processing permissions. Harden `system.yaml` configuration. Implement WAF rules.
Impact:
Remote Code Execution. Full Server Compromise. Data Breach. Backdoor Installation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
