Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
93 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Hi, actually we have sent the bug report to security@getgrav.org on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection (SSTI) via Denylist Bypass Vulnerability Summary: | Product | Grav CMS | | ----------------------- | --------------------------------------------- | | Vendor | Grav | | Severity | High - Users with login access to Grav Admin panel and page creation/update permissions are able to obtain remote code/command execution | | Affected Versions | <= v1.7.40 (Commit 685d762) (Latest version as of writing) | | Tested Versions | v1.7.40 | | Internal Identifier | STAR-2023-0006 | | CVE Identifier | Reserved CVE-2023-30592, CVE-2023-30593, CVE-2023-30594 | | CWE(s) | CWE-184: Incomplete List of Disallowed Inputs, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine | CVSS3.1 Scoring System: Base Score: 7.2 (High) Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Metric | Value | | ---------------------------- |…
Recommended action: Upgrade to 1.7.42 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Hi, actually we have sent the bug report to security@getgrav.org on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection (SSTI) via Insufficient Validation in filterFilter Summary: | Product | Grav CMS | | ----------------------- | --------------------------------------------- | | Vendor | Grav | | Severity | High - Users with login access to Grav Admin panel and page creation/update permissions are able to obtain remote code/command execution | | Affected Versions | <= v1.7.40 (Commit 685d762) (Latest version as of writing) | | Tested Versions | v1.7.40 | | Internal Identifier | STAR-2023-0007 | | CVE Identifier | TBD | | CWE(s) | CWE-20: Improper Input Validation, CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine | CVSS3.1 Scoring System: Base Score: 7.2 (High) Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | Metric | Value | | ---------------------------- | --------- | | Attack Vector (AV) | Network | | Attack…
Recommended action: Upgrade to 1.7.42 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
I found an RCE(Remote Code Execution) by SSTI in the admin screen. Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. PoC 1. Log in to the administrator screen and access the edit screen of the default page "Typography". (http://127.0.0.1:8000/admin/pages/typography) 2. Open the browser's console screen and execute the following JavaScript code to confirm that an arbitrary command (id) is being executed. Execution Result - Payload: {{['id']|map('system')|join}} - Payload: {{['cat /etc/passwd']|map('system')|join}} PoC Video - PoC Video Impact Remote Command Execution (RCE) is possible. Occurrences - https://github.com/getgrav/grav/blob/develop/system/src/Grav/Common/Twig/Extension/GravExtension.php#L174 References - PortSwigger: Server-side template injection - HackTricks: SSTI (Server Side Template Injection)
Recommended action: Upgrade to 1.7.42 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Grav is vulnerable to Server Side Template Injection via Twig. According to a previous vulnerability report, Twig should not render dangerous functions by default, such as system.
Recommended action: Upgrade to 1.7.34 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The BackupDelete functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to delete arbitrary files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
Recommended action: Upgrade to 1.6.30; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Backup functionality in Grav CMS through 1.7.0-rc.17 allows an authenticated attacker to read arbitrary local files on the underlying server by exploiting a path-traversal technique. (This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.)
Recommended action: Upgrade to 1.6.30; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Scheduler in Grav CMS through 1.7.0-rc.17 allows an attacker to execute a system command by tricking an admin into visiting a malicious website (CSRF).
Recommended action: Upgrade to 1.6.30; some affected versions have no fix yet, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in system/src/Grav/Common/Twig/Twig.php in Grav CMS before 1.3.0 allows remote attackers to inject arbitrary web script or HTML via the PATHINFO to admin/tools.
Recommended action: Upgrade to 1.3.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored cross-site scripting in GitHub repository getgrav/grav prior to 1.7.33.
Recommended action: Upgrade to 1.7.33 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Grav prior to 1.7.31 is vulnerable to stored cross-site scripting.
Recommended action: Upgrade to 1.7.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
User input is not properly sanitized leading to cross site scrpting (xss) in grav.
Recommended action: Upgrade to 1.7.31 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In grav prior to version 1.7.28, a low privilege user can create a page with arbitrary javascript by bypassing insufficent XSS filtering.
Recommended action: Upgrade to 1.7.28 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Common/Grav.php in Grav before 1.6.23 has an Open Redirect.
Recommended action: Upgrade to 1.6.23 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
grav prior to version 1.7.24 is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').
Recommended action: Upgrade to 1.7.24 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
grav is vulnerable to Reliance on Cookies without Validation and Integrity Checking. A cookie with an overly broad path can be accessed through other applications on the same domain. Since cookies often carry sensitive information such as session identifiers, sharing cookies across applications can lead a vulnerability in one application to cause a compromise in another.
Recommended action: Upgrade to 1.7.21 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Patches The issue was addressed by preventing dangerous functions from being called in Twig templates. A configuration option has been added to manually allow arbitrary PHP functions (system.twig.safefunctions) and filters (system.twig.safefilters). Futures major versions of Grav may disable this functionality by default. Workarounds Blocking access to the /admin path from untrusted sources will reduce the probability of exploitation. References - https://portswigger.net/research/server-side-template-injection - https://blog.sonarsource.com/grav-cms-code-execution-vulnerabilities For more information If you have any questions or comments about this advisory, you can contact: - The original reporters, by sending an…
Recommended action: Upgrade to 1.7.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Privileged users (with the ability to edit pages) have a mechanism to perform remote code execution via XSS. At a minimum, the vulnerability represents a bypass of security controls put in place to mitigate this form of attack. The remote code execution can be performed because XSS would allow an attacker to execute functionality on behalf of a stolen administrative account - the facility to install custom plugins would then allow said attacker to install a plugin containing a web shell and thus garner access to the underlying system. References https://owasp.org/www-project-top-ten/2017/A72017-Cross-SiteScripting(XSS) https://cheatsheetseries.owasp.org/cheatsheets/CrossSiteScriptingPreventionCheatSheet.html https://cwe.mitre.org/data/definitions/79.html For more information Please contact contact@pentest.co.uk
Recommended action: Upgrade to 1.6.30 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Grav through 1.6.15 allows (Stored) Cross-Site Scripting due to JavaScript execution in SVG images.
Recommended action: Upgrade to 1.7.0-beta.8 (pre-release) or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.