A vulnerability has been found in Grav up to 1.7.41 and classified as critical. Affected by this vulnerability is the function map/reduce of the file system/src/Grav/Common/Twig/Extension/GravExtension.php. The manipulation of the argument arrow with an unknown input leads to a injection vulnerability. The CWE definition for the vulnerability is CWE-74. The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Grav is a file-based Web platform. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.

The weakness was presented 06/15/2023 as GHSA-whr7-m3f8-mpm8. It is possible to read the advisory at github.com. This vulnerability is known as CVE-2023-34448 since 06/06/2023. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1055 according to MITRE ATT&CK.

By approaching the search of inurl:system/src/Grav/Common/Twig/Extension/GravExtension.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.74.2 eliminates this vulnerability. Applying the patch 8c2c1cb72611a399f13423fc6d0e1d998c03e5c8 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

See VDB-192319 and VDB-254288 for similar entries.

Productinfo

Name

• Grav

Version

• 1.7.0
• 1.7.1
• 1.7.2
• 1.7.3
• 1.7.4
• 1.7.5
• 1.7.6
• 1.7.7
• 1.7.8
• 1.7.9
• 1.7.10
• 1.7.11
• 1.7.12
• 1.7.13
• 1.7.14
• 1.7.15
• 1.7.16
• 1.7.17
• 1.7.18
• 1.7.19
• 1.7.20
• 1.7.21
• 1.7.22
• 1.7.23
• 1.7.24
• 1.7.25
• 1.7.26
• 1.7.27
• 1.7.28
• 1.7.29
• 1.7.30
• 1.7.31
• 1.7.32
• 1.7.33
• 1.7.34
• 1.7.35
• 1.7.36
• 1.7.37
• 1.7.38
• 1.7.39
• 1.7.40
• 1.7.41

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion