Listen to this Post
How the mentioned CVE works:
CVE-2024-31419 exploits a Server-Side Template Injection (SSTI) vulnerability in Grav CMS’s forms plugin. When a form is submitted via POST, the ‘unique_form_id’ field is improperly sanitized and passed directly to the Twig templating engine. An attacker can inject Twig template code into this field, such as {{var_dump(_context|slice(0,7))}}. This payload is evaluated on the server, executing Twig commands to dump the template context array. By manipulating the slice or using other Twig functions, attackers can extract sensitive configuration details, including plugin settings, database credentials, and system information. The vulnerability arises from unsanitized user input being interpreted as Twig syntax, allowing remote template injection. Exploitation requires a form with accessible fields, but public forms suffice. This leads to information disclosure and potential remote code execution by leveraging Twig’s capabilities, compromising the Grav instance.
Platform: Grav CMS
Version: 1.7.48
Vulnerability: Server-Side Template Injection
Severity: Critical
Date: 25 March 2025
Prediction: Patch Expected April 2025
What Undercode Say:
Analytics:
curl -X POST [target-url] -d “registration-number=d643aaaa&hp=vJyifp&form-name=hero-form&unique_form_id={{var_dump(_context|slice(0,7))}}”
Payload: unique_form_id={{var_dump(_context|slice(0,7))}}
How Exploit:
Craft POST request with malicious Twig payload in unique_form_id field to dump configuration.
Protection from this CVE:
Update Grav CMS and forms plugin to patched versions. Sanitize form input.
Impact:
Sensitive configuration disclosure, potential remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
