CVE-2024-34082
📋 TL;DR
This vulnerability in Grav CMS allows low-privileged users with page edit permissions to read arbitrary server files using Twig syntax, including sensitive user account files containing password hashes, 2FA secrets, and password reset tokens. This can lead to account compromise and full system takeover. All Grav installations with user accounts are affected.
💻 Affected Systems
- Grav CMS
📦 What is this software?
Grav by Getgrav
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains administrative access, reads all server files, and takes over all user accounts including administrators.
Likely Case
Account takeover of regular users and administrators through password hash cracking or password reset token theft, potentially leading to data exfiltration.
If Mitigated
Limited impact if proper access controls and monitoring are in place, but still significant risk due to file read capability.
🎯 Exploit Status
Exploitation requires authenticated low-privilege access but is straightforward using Twig syntax. Public proof-of-concept exists in advisory references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.7.46
Vendor Advisory: https://github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69
Restart Required: No
Instructions:
1. Backup your Grav installation. 2. Update Grav to version 1.7.46 or later via composer (composer update getgrav/grav) or manual download. 3. Clear cache if needed. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict Page Edit Permissions
allTemporarily remove page edit permissions from all non-administrative users until patching is complete.
Edit user account YAML files to remove 'pages: edit' permissions
File System Restrictions
linuxImplement strict file system permissions to limit web server access to sensitive directories.
chmod 600 /grav/user/accounts/*.yaml
chown root:root /grav/user/accounts/*.yaml
🧯 If You Can't Patch
- Immediately audit and restrict all user accounts with page edit permissions to trusted administrators only.
- Implement strict monitoring of user account YAML files for unauthorized access attempts and review audit logs daily.
🔍 How to Verify
Check if Vulnerable:
Check Grav version in admin panel or via CLI: php bin/grav version. If version is below 1.7.46, you are vulnerable.Check Version:
php bin/grav versionVerify Fix Applied:
Confirm version is 1.7.46 or higher: php bin/grav version. Test that low-privilege users cannot access sensitive files via page editing.📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Multiple failed authentication attempts followed by successful login from new locations
- Suspicious Twig syntax in page edit requests
Network Indicators:
- Unusual outbound traffic patterns after user login
- Multiple password reset requests for different accounts
SIEM Query:
source="web_server_logs" AND (uri CONTAINS "/admin/pages" OR uri CONTAINS "twig") AND (response_code=200 OR response_code=302) AND user_agent NOT IN ["expected_user_agents"]🔗 References
- https://github.com/getgrav/grav/commit/b6bba9eb99bf8cb55b8fa8d23f18873ca594e348
- https://github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69
- https://github.com/getgrav/grav/commit/b6bba9eb99bf8cb55b8fa8d23f18873ca594e348
- https://github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69
