{"id":"CVE-2023-34448","published":"2023-06-14T22:06:01Z","modified":"2024-12-18T21:38:44Z","title":"Grav Server-side Template Injection (SSTI) via Twig Default Filters","vendor":"getgrav","product":"grav","tier":"tail","description":{"text":"Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04515,"percentile":0.91512,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"},{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8","tags":["x_refsource_MISC"]},{"url":"https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148","tags":["x_refsource_MISC"]},{"url":"https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/","tags":["x_refsource_MISC"]},{"url":"https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83","tags":["x_refsource_MISC"]}],"priority":{"score":24.5,"factors":[{"name":"EPSS percentile","points":18.3},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"getgrav","affectedVersions":[{"vendor":"getgrav","product":"grav","versions":["< 1.7.42"]}],"affected":[{"ecosystem":"Packagist","package":"getgrav/grav","vulnerableRanges":["<1.7.42"],"patched":["1.7.42"],"from":["GHSA-whr7-m3f8-mpm8"],"provenance":"source"}],"euvd":{"id":"EUVD-2023-1902","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-getgrav-grav-cve-2022-2073","parents":[{"from":"CVE-2022-2073","to":"CVE-2023-34448","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be…","from":"CVE.org","in":"CVE-2023-34448"},{"kind":"same-code","provenance":"machine","files":["system/src/Grav/Common/Twig/Extension/GravExtension.php"],"commits":["https://github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83","https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8","https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec"],"basis":"shared function","functions":["getFilters","ofTypeFunc"]}]}],"children":[{"from":"CVE-2023-34448","to":"CVE-2023-37897","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["system/src/Grav/Common/Utils.php"],"commits":["https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8","https://github.com/getgrav/grav/commit/244758d4383034fe4cd292d41e477177870b65ec","https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b","https://github.com/getgrav/grav/commit/b4c62101a43051fc7f5349c7d0a5b6085375c1d7"],"basis":"shared function","functions":["getSupportPageTypes","isDangerousFunction"]}]}]}}