CVE-2024-28119
published 2024-03-21CVE-2024-28119: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context…
PriorityP261high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
1.58%
72.5th percentile
Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a patch for this issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getgrav | grav | < 1.7.45 | 1.7.45 |
| getgrav | grav | >= 0 < 1.7.45 | 1.7.45 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Server Side Template Injection (SSTI) via Twig escape handler
ghsa·2024-03-22
CVE-2024-28119 [HIGH] CWE-94 Server Side Template Injection (SSTI) via Twig escape handler
Server Side Template Injection (SSTI) via Twig escape handler
### Summary
Due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands.
### Details
https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L99
```php
/**
* Defines a new escaper to be used via the escape filter.
*
* @param string $strategy The strategy name that should be used as a strategy in the escape call
* @param callable $callable A valid PHP callable
*/
public function setEscaper($strategy, callable $callable)
{
$this->escapers[$strategy] = $callable;
}
```
Twig supports the functionality to redefine the escape function through the setEscaper method.
However, that method is not originally exposed to the twig e
OSV
Server Side Template Injection (SSTI) via Twig escape handler
osv·2024-03-22
CVE-2024-28119 [HIGH] Server Side Template Injection (SSTI) via Twig escape handler
Server Side Template Injection (SSTI) via Twig escape handler
### Summary
Due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands.
### Details
https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L99
```php
/**
* Defines a new escaper to be used via the escape filter.
*
* @param string $strategy The strategy name that should be used as a strategy in the escape call
* @param callable $callable A valid PHP callable
*/
public function setEscaper($strategy, callable $callable)
{
$this->escapers[$strategy] = $callable;
}
```
Twig supports the functionality to redefine the escape function through the setEscaper method.
However, that method is not originally exposed to the twig e
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fehttps://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L99https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fehttps://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58https://github.com/twigphp/Twig/blob/3.x/src/Extension/EscaperExtension.php#L99
2024-03-21
Published