CVE-2023-34252 (PHP, published 2023-06-14T22:15Z)
Description: value: Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the `GravExtension.filterFilter()` function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a callable argument allows the validation check to be skipped. Consequently, a low privileged attacker with login access to Grav Admin panel and page creation/update permissions is able to inject malicious templates to obtain remote code execution. The vulnerability can be found in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Version 1.7.42 contains a patch for this issue. End users should also ensure that `twig.undefined_functions` and `twig.undefined_filters` properties in `/path/to/webroot/system/config/system.yaml` configuration file are set to `false` to disallow Twig from treating undefined filters/functions as PHP functions and executing them.
Severity: nan (CVSS v3 base score: 7.2)
Weakness: CWE-94 \u2014 Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Repository: https://github.com/getgrav/grav
Files changed:
CHANGELOG.md
system/src/Grav/Common/Twig/Extension/GravExtension.php
Commit message: also handle SSTI in reduce twig filter + function


Vulnerable code:
   * More robust SSTI handling in `|filter` and `|map`
            // Security fix
            new TwigFilter('filter', [$this, 'filterFilter'], ['needs_environment' => true]),
            new TwigFilter('map', [$this, 'mapFilter'], ['needs_environment' => true]),
    function filterFilter(Environment $env, $array, $arrow)
    function mapFilter(Environment $env, $array, $arrow)

Fixed code:
   * More robust SSTI handling in `filter`, `map`, and `reduce` Twig filters and functions
   * Fixed Twig `|reduce()` allowing code execution
            // Security fixes
            new TwigFilter('filter', [$this, 'filterFunc'], ['needs_environment' => true]),
            new TwigFilter('map', [$this, 'mapFunc'], ['needs_environment' => true]),
            new TwigFilter('reduce', [$this, 'reduceFunc'], ['needs_environment' => true]),

            // Security fixes
            new TwigFunction('filter', [$this, 'filterFunc'], ['needs_environment' => true]),
            new TwigFunction('map', [$this, 'mapFunc'], ['needs_environment' => true]),
            new TwigFunction('reduce', [$this, 'reduceFunc'], ['needs_environment' => true]),
    function filterFunc(Environment $env, $array, $arrow)
    function mapFunc(Environment $env, $array, $arrow)

    /**
     * @param Environment $env
     * @param array $array
     * @param callable|string $arrow
     * @return array|CallbackFilterIterator
     * @throws RuntimeError
     */
    function reduceFunc(Environment $env, $array, $arrow)
    {
        if (!$arrow instanceof \Closure && !is_string($arrow) || Utils::isDangerousFunction($arrow)) {
            throw new RuntimeError('Twig |reduce("' . $arrow . '") is not allowed.');
        }

        return twig_array_map($env, $array, $arrow);
    }