{"id":"CVE-2023-34252","published":"2023-06-14T21:38:48Z","modified":"2024-12-18T19:03:09Z","title":"Grav Server-side Template Injection via Insufficient Validation in filterFilter","vendor":"getgrav","product":"grav","tier":"tail","description":{"text":"Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02074,"percentile":0.81441,"provenance":"source"},"cwes":[{"id":"CWE-184","name":"Incomplete List of Disallowed Inputs"},{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-96xv-rmwj-6p9w","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec","tags":["x_refsource_MISC"]},{"url":"https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Twig/Extension/GravExtension.php#L1692-L1698","tags":["x_refsource_MISC"]},{"url":"https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1956-L2074","tags":["x_refsource_MISC"]}],"priority":{"score":22.4,"factors":[{"name":"EPSS percentile","points":16.29},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"getgrav","affectedVersions":[{"vendor":"getgrav","product":"grav","versions":["< 1.7.42"]}],"affected":[{"ecosystem":"Packagist","package":"getgrav/grav","vulnerableRanges":["<1.7.42"],"patched":["1.7.42"],"from":["GHSA-96xv-rmwj-6p9w"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1758","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-getgrav-grav-cve-2022-2073","parents":[{"from":"CVE-2022-2073","to":"CVE-2023-34252","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["system/src/Grav/Common/Twig/Extension/GravExtension.php"],"commits":["https://github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83","https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec","https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b"],"basis":"shared function","functions":["getFilters","ofTypeFunc"]}]}]}}