CVE-2024-28118
📋 TL;DR
This vulnerability in Grav CMS allows administrative users to bypass SSTI mitigations and execute arbitrary code through Twig template processing. Attackers can gain elevated privileges and take full control of the instance. Only Grav instances with administrative users who can create/edit pages are affected.
💻 Affected Systems
- Grav CMS
📦 What is this software?
Grav by Getgrav
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with arbitrary code execution leading to data theft, lateral movement, and persistent backdoor installation.
Likely Case
Administrative user exploits the vulnerability to gain full control of the Grav instance, potentially compromising sensitive content and user data.
If Mitigated
Limited to administrative users only, with proper access controls reducing attack surface to trusted personnel.
🎯 Exploit Status
Exploitation requires administrative credentials but is straightforward once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.45
Vendor Advisory: https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4
Restart Required: No
Instructions:
1. Backup your Grav installation. 2. Update to version 1.7.45 via package manager or manual download. 3. Clear cache if needed.
🔧 Temporary Workarounds
Disable Twig processing for non-trusted users
allRestrict administrative privileges and disable Twig processing in page front matter for untrusted users.
🧯 If You Can't Patch
- Restrict administrative access to only essential, trusted personnel
- Implement network segmentation to isolate Grav instances from critical systems
🔍 How to Verify
Check if Vulnerable:
Check Grav version in admin panel or via CLI: php bin/grav versionCheck Version:
php bin/grav versionVerify Fix Applied:
Confirm version is 1.7.45 or higher: php bin/grav version📡 Detection & Monitoring
Log Indicators:
- Unusual administrative activity
- Unexpected page creation/editing with Twig content
- System command execution in logs
Network Indicators:
- Unexpected outbound connections from Grav server
- Unusual HTTP requests to administrative endpoints
SIEM Query:
source="grav_logs" AND (event="page_edit" OR event="page_create") AND content CONTAINS "twig"🔗 References
- https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe
- https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4
- https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe
- https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4
