hitoshura25/cvefixes huggingface dataset:
CVE-2023-34253 (PHP, published 2023-06-14T23:15Z)
Description: value: Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- (1) using unsafe functions that are not banned, (2) using capitalised callable names, and (3) using fully-qualified names for referencing callables. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. A patch in version 1.7.42 improves the denylist.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Utils.php
Commit message: more SSTI fixes in Utils::isDangerousFunction()


Vulnerable code:
     * @param string|array $name

Fixed code:
   * Various SSTI improvements `Utils::isDangerousFunction()`
     * @param string|array|Closure $name
            'unserialize',
            'ini_alter',
            'simplexml_load_file',
            'simplexml_load_string',
            'forward_static_call',
            'forward_static_call_array',
        $name = strtolower($name);

        if ($name instanceof \Closure) {
            return false;
        }

        if (strpos($name, "\\") !== false) {
            return false;
        }
CVE-2023-34448 (PHP, published 2023-06-14T23:15Z)
Description: value: Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Twig/Extension/GravExtension.php
system/src/Grav/Common/Utils.php
Commit message: better SSTI in |map and |filter


Vulnerable code:
   * * Fixed Twig `|map()` allowing code execution
        if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
        if (is_string($arrow) && Utils::isDangerousFunction($arrow)) {
     * @param string $name
    public static function isDangerousFunction(string $name): bool

Fixed code:
1. [](#improved)
   * More robust SSTI handling in `|filter` and `|map`
   * Fixed Twig `|map()` allowing code execution
        if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
        if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
     * @param string|array $name
    public static function isDangerousFunction($name): bool
        if (is_array($name) || strpos($name, ":") !== false) {
            return false;
        }
CVE-2023-37897 (PHP, published 2023-07-18T21:15Z)
Description: value: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-393 \u2014 Return of Wrong Status Code
A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Data/Validation.php
system/src/Grav/Common/Utils.php
Commit message: SSTI attack mitigation - GHSA-9436-3gmp-4f53


Vulnerable code:
            return false;

Fixed code:
# v1.7.42.2
## mm/dd/2023

2. [](#improved)
   * In `Utils::isDangerousFunction`, handle double `\\` in `|map` twig filter to mitigate SSTI attack
   * Better handle empty email in `Validatoin::typeEmail()`

        if (empty($value)) {
            return false;
        }

            return true;
CVE-2023-37897 (PHP, published 2023-07-18T21:15Z)
Description: value: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Data/Validation.php
system/src/Grav/Common/Utils.php
Commit message: SSTI attack mitigation - GHSA-9436-3gmp-4f53


Vulnerable code:
            return false;

Fixed code:
# v1.7.42.2
## mm/dd/2023

2. [](#improved)
   * In `Utils::isDangerousFunction`, handle double `\\` in `|map` twig filter to mitigate SSTI attack
   * Better handle empty email in `Validatoin::typeEmail()`

        if (empty($value)) {
            return false;
        }

            return true;
CVE-2023-37897 (PHP, published 2023-07-18T21:15Z)
Description: value: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-393 \u2014 Return of Wrong Status Code
A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Utils.php
Commit message: more SSTI fixes in Utils::isDangerousFunction()


Vulnerable code:
     * @param string|array $name

Fixed code:
   * Various SSTI improvements `Utils::isDangerousFunction()`
     * @param string|array|Closure $name
            'unserialize',
            'ini_alter',
            'simplexml_load_file',
            'simplexml_load_string',
            'forward_static_call',
            'forward_static_call_array',
        $name = strtolower($name);

        if ($name instanceof \Closure) {
            return false;
        }

        if (strpos($name, "\\") !== false) {
            return false;
        }
CVE-2023-37897 (PHP, published 2023-07-18T21:15Z)
Description: value: Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using `|map`, `|filter` and `|reduce` twigs implemented in the commit `71bbed1` introduces bypass of the denylist due to incorrect return value from `isDangerousFunction()`, which allows to execute the payload prepending double backslash (`\\`). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the `\` symbol is found in the `$name`. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit `b4c6210` and is included in release version `1.7.42.2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.


Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Utils.php
Commit message: more SSTI fixes in Utils::isDangerousFunction()


Vulnerable code:
     * @param string|array $name

Fixed code:
   * Various SSTI improvements `Utils::isDangerousFunction()`
     * @param string|array|Closure $name
            'unserialize',
            'ini_alter',
            'simplexml_load_file',
            'simplexml_load_string',
            'forward_static_call',
            'forward_static_call_array',
        $name = strtolower($name);

        if ($name instanceof \Closure) {
            return false;
        }

        if (strpos($name, "\\") !== false) {
            return false;
        }
CVE-2024-27921 (PHP, published 2024-03-21T22:15Z)
Description: value: Grav is an open-source, flat-file content management system. A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. This critical security flaw poses severe risks, that can allow attackers to inject arbitrary code on the server, undermine integrity of backup files by overwriting existing files or creating new ones, and exfiltrate sensitive data using CSS exfiltration techniques. Upgrading to patched version 1.7.45 can mitigate the issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Utils.php
Commit message: fixed path traversal by santize checking fiilename


Vulnerable code:

Fixed code:
   * Fixed a path traversal vulnerability with file uploads [GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
            // Filename should not contain path traversal
            || str_replace('..', '', $filename) !== $filename
CVE-2024-27923 (Markdown, published 2024-03-21T02:52Z)
Description: value: Grav is a content management system (CMS). Prior to version 1.7.43, users who may write a page may use the `frontmatter` feature due to insufficient permission validation and inadequate file name validation. This may lead to remote code execution. Version 1.7.43 fixes this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/config/security.yaml
Commit message: inlcude phar in dangerous extensions


Vulnerable code:

Fixed code:
# v1.7.42.4
## mm/dd/2023

2. [](#improved)
   * Include `phar` in the list of `security.uploads_dangerous_extensions`

    - phar
CVE-2024-28116 (PHP, published 2024-03-21T22:15Z)
Description: value: Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing the existing security sandbox. Version 1.7.45 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
Commit message: fix for safe_functions attack #GHSA-c9gp-64c4-2rrh


Vulnerable code:
   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv)

Fixed code:
   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv) [#GHSA-c9gp-64c4-2rrh](https://github.com/getgrav/grav/security/advisories/GHSA-c9gp-64c4-2rrh)
            'twig.safe_functions',
CVE-2024-28117 (PHP, published 2024-03-21T22:15Z)
Description: value: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Upgrading to patched version 1.7.45 can mitigate this issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
system/src/Grav/Common/Twig/Twig.php
Commit message: Mitigate various SSTI injections


Vulnerable code:
   * Fixed a path traversal vulnerability with file uploads [GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
            // set the page now its been processed
            $twig_vars['content'] = $page->content();

Fixed code:
   * Fixed a path traversal vulnerability with file uploads [#GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv)

    public static function cleanDangerousTwig(string $string): string
    {
        if ($string === '') {
            return $string;
        }

        $bad_twig = [
            'twig_array_map',
            'twig_array_filter',
            'call_user_func',
            'registerUndefinedFunctionCallback',
            'undefined_functions',
            'twig.getFunction',
            'core.setEscaper',
        ];
        $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
        return $string;
    }
use Grav\Common\Security;
        $content = Security::cleanDangerousTwig($content);
        $string = Security::cleanDangerousTwig($string);

            // set the page now it's been processed
            $content = Security::cleanDangerousTwig($page->content());

            $twig_vars['content'] = $content;
CVE-2024-28118 (PHP, published 2024-03-21T22:15Z)
Description: value: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a fix for this issue.

Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
system/src/Grav/Common/Twig/Twig.php
Commit message: Mitigate various SSTI injections


Vulnerable code:
   * Fixed a path traversal vulnerability with file uploads [GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
            // set the page now its been processed
            $twig_vars['content'] = $page->content();

Fixed code:
   * Fixed a path traversal vulnerability with file uploads [#GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv)

    public static function cleanDangerousTwig(string $string): string
    {
        if ($string === '') {
            return $string;
        }

        $bad_twig = [
            'twig_array_map',
            'twig_array_filter',
            'call_user_func',
            'registerUndefinedFunctionCallback',
            'undefined_functions',
            'twig.getFunction',
            'core.setEscaper',
        ];
        $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
        return $string;
    }
use Grav\Common\Security;
        $content = Security::cleanDangerousTwig($content);
        $string = Security::cleanDangerousTwig($string);

            // set the page now it's been processed
            $content = Security::cleanDangerousTwig($page->content());

            $twig_vars['content'] = $content;
CVE-2024-28119 (PHP, published 2024-03-21T22:15Z)
Description: value: Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. Version 1.7.45 contains a patch for this issue.
Severity: nan (CVSS v3 base score: )
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Security.php
system/src/Grav/Common/Twig/Twig.php
Commit message: Mitigate various SSTI injections


Vulnerable code:
   * Fixed a path traversal vulnerability with file uploads [GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
            // set the page now its been processed
            $twig_vars['content'] = $page->content();

Fixed code:
   * Fixed a path traversal vulnerability with file uploads [#GHSA-m7hx-hw6h-mqmc](https://github.com/getgrav/grav/security/advisories/GHSA-m7hx-hw6h-mqmc)
   * Fixed a security issue with insecure Twig functions be processed [#GHSA-2m7x-c7px-hp58](https://github.com/getgrav/grav/security/advisories/GHSA-2m7x-c7px-hp58) [#GHSA-r6vw-8v8r-pmp4](https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4) [#GHSA-qfv4-q44r-g7rv](https://github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv)

    public static function cleanDangerousTwig(string $string): string
    {
        if ($string === '') {
            return $string;
        }

        $bad_twig = [
            'twig_array_map',
            'twig_array_filter',
            'call_user_func',
            'registerUndefinedFunctionCallback',
            'undefined_functions',
            'twig.getFunction',
            'core.setEscaper',
        ];
        $string = preg_replace('/(({{\s*|{%\s*)[^}]*?(' . implode('|', $bad_twig) . ')[^}]*?(\s*}}|\s*%}))/i', '{# $1 #}', $string);
        return $string;
    }
use Grav\Common\Security;
        $content = Security::cleanDangerousTwig($content);
        $string = Security::cleanDangerousTwig($string);

            // set the page now it's been processed
            $content = Security::cleanDangerousTwig($page->content());

            $twig_vars['content'] = $content;