Grav vulnerability allows arbitrary code execution and elevated privileges

CVE-2024-28118

What is CVE-2024-28118?

Grav is an open-source, flat-file content management system that suffers from a significant vulnerability due to unrestricted access to the Twig extension class within the Grav context. Prior to version 1.7.45, an attacker could exploit this flaw to redefine configuration variables, effectively bypassing previously established Server-Side Template Injection (SSTI) mitigations. This issue arises when administrative users, authorized to create or edit pages, enable Twig processing in static pages' front matter. Because the Twig processor operates without sandboxing, attackers can utilize this vulnerability to achieve arbitrary code execution within the system, potentially leading to privilege escalation. The release of version 1.7.45 addresses this vulnerability, ensuring the security of Grav instances.

References