Grav is a file-based Web-platform built in PHP. Grav is subject to a server side template injection (SSTI) vulnerability. The fix for another SSTI vulnerability using |map
, |filter
and |reduce
twigs implemented in the commit 71bbed1
introduces bypass of the denylist due to incorrect return value from isDangerousFunction()
, which allows to execute the payload prepending double backslash (). The `isDangerousFunction()` check in version 1.7.42 and onwards retuns `false` value instead of `true` when the
symbol is found in the $name
. This vulnerability can be exploited if the attacker has access to: 1. an Administrator account, or 2. a non-administrator, user account that has Admin panel access and Create/Update page permissions. A fix for this vulnerability has been introduced in commit b4c6210
and is included in release version 1.7.42.2
. Users are advised to upgrade. There are no known workarounds for this vulnerability.
A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Grav | Getgrav | 1.7.42 (including) | 1.7.42 (including) |
Grav | Getgrav | 1.7.42.1 (including) | 1.7.42.1 (including) |