CVE-2023-34253
📋 TL;DR
This vulnerability allows attackers with login access to Grav's Admin panel and page creation/update permissions to inject malicious templates and achieve remote code execution. The insufficient denylist in Grav's template system can be bypassed using unsafe functions not banned, capitalized callable names, or fully-qualified names. All Grav installations prior to version 1.7.42 with the Admin plugin enabled are affected.
💻 Affected Systems
- Grav CMS
📦 What is this software?
Grav by Getgrav
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with remote code execution, allowing attackers to execute arbitrary commands, access sensitive data, install malware, or pivot to other systems.
Likely Case
Attackers with valid admin credentials achieve remote code execution, potentially leading to data theft, website defacement, or deployment of backdoors.
If Mitigated
Limited impact if proper access controls restrict admin panel access and template editing permissions to trusted users only.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. Multiple bypass methods exist.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.42
Vendor Advisory: https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm
Restart Required: No
Instructions:
1. Backup your Grav installation. 2. Update Grav to version 1.7.42 or later via the built-in GPM (Grav Package Manager) or manually. 3. Clear the cache: `bin/grav clear-cache`. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict Admin Panel Access
allLimit access to the Grav Admin panel to trusted IP addresses only using web server configuration or firewall rules.
Disable Template Editing
allRemove page creation/update permissions from non-essential admin users to prevent template injection.
🧯 If You Can't Patch
- Implement strict access controls to the Grav Admin panel, allowing only trusted administrators.
- Monitor for suspicious template modifications and admin panel login attempts from unusual locations.
🔍 How to Verify
Check if Vulnerable:
Check your Grav version by running `bin/grav version` or viewing the Admin panel dashboard. If version is below 1.7.42, you are vulnerable.Check Version:
bin/grav versionVerify Fix Applied:
After updating, confirm version is 1.7.42 or higher using `bin/grav version`. Test that template injection attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual template file modifications
- Suspicious PHP function calls in logs
- Multiple failed login attempts followed by successful admin login
Network Indicators:
- Unexpected outbound connections from Grav server
- Unusual traffic patterns to admin panel
SIEM Query:
source="grav_logs" AND ("template injection" OR "eval(" OR "system(" OR "exec(")🔗 References
- https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190
- https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b
- https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm
- https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/
- https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83
- https://github.com/getgrav/grav/blob/1.7.40/system/src/Grav/Common/Utils.php#L1952-L2190
- https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b
- https://github.com/getgrav/grav/security/advisories/GHSA-j3v8-v77f-fvgm
- https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/
- https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfeb83
