CVE-2023-34253: Improper Control of Generation of Code ('Code Injection') (CWE-94)
value: Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.
CWE description: The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVSS v3 base score: 7.2
Published: 2023-06-14T23:15Z
Repository: https://github.com/getgrav/grav
Language: PHP
Files changed: CHANGELOG.md, system/src/Grav/Common/Utils.php
Commit date: 2023-06-13 17:57:11 -0600
Commit message: more SSTI fixes in Utils::isDangerousFunction()

Diff: diff --git a/CHANGELOG.md b/CHANGELOG.md
index b5d69dcfeb..a3c5934046 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,10 +3,11 @@
 
 1. [](#new)
    * Added a new `system.languages.debug` option that adds a `<span class="translate-debug"></span>` around strings translated with `|t`. This can be styled by the theme as needed.
 1. [](#improved)
    * More robust SSTI handling in `|filter` and `|map`
+   * Various SSTI improvements `Utils::isDangerousFunction()`
 1. [](#bugfix)
    * Fixed Twig `|map()` allowing code execution
 
 # v1.7.41.2
 ## 06/01/2023
diff --git a/system/src/Grav/Common/Utils.php b/system/src/Grav/Common/Utils.php
index 24a7417797..14748a558d 100644
--- a/system/src/Grav/Common/Utils.php
+++ b/system/src/Grav/Common/Utils.php
@@ -1948,11 +1948,11 @@ abstract class Utils
 
         return $types;
     }
 
     /**
-     * @param string|array $name
+     * @param string|array|Closure $name
      * @return bool
      */
     public static function isDangerousFunction($name): bool
     {
         static $commandExecutionFunctions = [
@@ -2046,12 +2046,28 @@ abstract class Utils
             'posix_kill',
             'posix_mkfifo',
             'posix_setpgid',
             'posix_setsid',
             'posix_setuid',
+            'unserialize',
+            'ini_alter',
+            'simplexml_load_file',
+            'simplexml_load_string',
+            'forward_static_call',
+            'forward_static_call_array',
         ];
 
+        $name = strtolower($name);
+
+        if ($name instanceof \Closure) {
+            return false;
+        }
+
+        if (strpos($name, "\\") !== false) {
+            return false;
+        }
+
         if (is_array($name) || strpos($name, ":") !== false) {
             return false;
         }
 
         if (in_array($name, $commandExecutionFunctions)) {

Vulnerable code:      * @param string|array $name
Fixed code:    * Various SSTI improvements `Utils::isDangerousFunction()`
     * @param string|array|Closure $name
            'unserialize',
            'ini_alter',
            'simplexml_load_file',
            'simplexml_load_string',
            'forward_static_call',
            'forward_static_call_array',
        $name = strtolower($name);

        if ($name instanceof \Closure) {
            return false;
        }

        if (strpos($name, "\\") !== false) {
            return false;
        }