CVE-2023-37897
📋 TL;DR
Grav CMS versions 1.7.42 and later contain a server-side template injection vulnerability due to an incorrect security check that allows bypassing function denylists. Attackers with administrator access or non-administrator users with admin panel and page creation/update permissions can execute arbitrary code. This vulnerability stems from a flawed fix for a previous SSTI issue where the isDangerousFunction() check returns false instead of true when encountering double backslashes.
💻 Affected Systems
- Grav CMS
📦 What is this software?
Grav by Getgrav
Grav by Getgrav
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing remote code execution, data exfiltration, and complete system control.
Likely Case
Unauthorized content modification, privilege escalation, and potential data breach through template injection.
If Mitigated
Limited impact if strict access controls prevent unauthorized users from accessing admin functions.
🎯 Exploit Status
Exploitation requires authenticated access but uses simple payload construction with double backslashes.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.42.2
Vendor Advisory: https://github.com/getgrav/grav/security/advisories/GHSA-9436-3gmp-4f53
Restart Required: No
Instructions:
1. Backup your Grav installation. 2. Update Grav to version 1.7.42.2 or later via GPM: 'bin/gpm selfupgrade' then 'bin/gpm update'. 3. Verify the update completed successfully.
🧯 If You Can't Patch
- Restrict admin panel access to trusted users only using IP whitelisting or VPN.
- Remove create/update page permissions from non-administrator users.
🔍 How to Verify
Check if Vulnerable:
Check Grav version in system/config/system.yaml or via CLI: 'bin/grav version'. If version is 1.7.42 or 1.7.42.1, system is vulnerable.Check Version:
bin/grav versionVerify Fix Applied:
Confirm version is 1.7.42.2 or later using 'bin/grav version' command.📡 Detection & Monitoring
Log Indicators:
- Unusual admin panel activity from unexpected users
- Template modification attempts with backslash characters
- PHP execution errors in web server logs
Network Indicators:
- POST requests to admin pages containing template injection payloads
- Unusual outbound connections from Grav server
SIEM Query:
source="web_access.log" AND (uri="/admin/*" AND (method="POST" OR method="PUT") AND (body="\\" OR body="|map" OR body="|filter" OR body="|reduce"))🔗 References
- https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b
- https://github.com/getgrav/grav/commit/b4c62101a43051fc7f5349c7d0a5b6085375c1d7
- https://github.com/getgrav/grav/security/advisories/GHSA-9436-3gmp-4f53
- https://github.com/getgrav/grav/commit/71bbed12f950de8335006d7f91112263d8504f1b
- https://github.com/getgrav/grav/commit/b4c62101a43051fc7f5349c7d0a5b6085375c1d7
- https://github.com/getgrav/grav/security/advisories/GHSA-9436-3gmp-4f53
