Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

CVE-2023-34253

What is CVE-2023-34253?

Grav, a popular flat-file content management system, has a vulnerability that stems from an insufficient denylist implementation. This flaw allows a low-privileged user with access to the Grav Admin panel and permissions for page creation or updates to exploit the system. Attackers can inject malicious templates through various methods, including the use of unsafe functions that are not explicitly banned, exploiting capitalized callable names, or by referencing callables using fully-qualified names. This can lead to potential remote code execution. Version 1.7.42 introduces a patch that strengthens the denylist to mitigate this risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References