CVE-2023-37897: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)
value: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


CWE description: The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CVSS v3 base score: 8.8
Published: 2023-07-18T21:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Utils.php
Commit date: 2023-06-13 17:57:11 -0600
Commit message: more SSTI fixes in Utils::isDangerousFunction()

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5d69dcfeb..a3c5934046 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,11 @@
 
 1. [](#new)
    * Added a new `system.languages.debug` option that adds a `<span class="translate-debug"></span>` around strings translated with `|t`. This can be styled by the theme as needed.
 1. [](#improved)
    * More robust SSTI handling in `|filter` and `|map`
+   * Various SSTI improvements `Utils::isDangerousFunction()`
 1. [](#bugfix)
    * Fixed Twig `|map()` allowing code execution
 
 # v1.7.41.2
 ## 06/01/2023
diff --git a/system/src/Grav/Common/Utils.php b/system/src/Grav/Common/Utils.php
index 24a7417797..14748a558d 100644
--- a/system/src/Grav/Common/Utils.php
+++ b/system/src/Grav/Common/Utils.php
@@ -1948,11 +1948,11 @@ abstract class Utils
 
         return $types;
     }
 
     /**
-     * @param string|array $name
+     * @param string|array|Closure $name
      * @return bool
      */
     public static function isDangerousFunction($name): bool
     {
         static $commandExecutionFunctions = [
@@ -2046,12 +2046,28 @@ abstract class Utils
             'posix_kill',
             'posix_mkfifo',
             'posix_setpgid',
             'posix_setsid',
             'posix_setuid',
+            'unserialize',
+            'ini_alter',
+            'simplexml_load_file',
+            'simplexml_load_string',
+            'forward_static_call',
+            'forward_static_call_array',
         ];
 
+        $name = strtolower($name);
+
+        if ($name instanceof \Closure) {
+            return false;
+        }
+
+        if (strpos($name, "\\") !== false) {
+            return false;
+        }
+
         if (is_array($name) || strpos($name, ":") !== false) {
             return false;
         }
 
         if (in_array($name, $commandExecutionFunctions)) {

Vulnerable code:      * @param string|array $name
Fixed code:    * Various SSTI improvements `Utils::isDangerousFunction()`
     * @param string|array|Closure $name
            'unserialize',
            'ini_alter',
            'simplexml_load_file',
            'simplexml_load_string',
            'forward_static_call',
            'forward_static_call_array',
        $name = strtolower($name);

        if ($name instanceof \Closure) {
            return false;
        }

        if (strpos($name, "\\") !== false) {
            return false;
        }