Server-side Template Injection(SSTI)

getgrav/grav is vulnerable to Server-side Template InjectionSSTI. Malicious PHP code can be executed remotely by an authenticated attacker with page editing privileges resulting in remote code execution...

Server-side Template Injection(SSTI)

getgrav/grav is vulnerable to Server-side Template InjectionSSTI. The vulnerability exists in filterFilter function of GravExtension.php, because an array might omit the validation check when the parameter is a string. This enables an authenticated attacker to insert malicious templates and perfo...

Server-Side Template Injection (SSTI)

getgrav/grav is vulnerable to Server-Side Template Injection SSTI. The vulnerability exists because the Filter function of GravExtension.php does not properly block the other built-in functions exposed by Twig's Core Extension, which allows an attacker to invoke arbitrary unsafe functions, leadin...

GHSA-WHR7-M3F8-MPM8 Grav Server-side Template Injection (SSTI) via Twig Default Filters

Hi, actually we have sent the bug report to [email protected] on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection SSTI via Twig Default Filters Summary: | Product | Grav CMS | | ----------------------- | --------------------------------------------- | | Vendor | Grav...

Grav Server-side Template Injection (SSTI) via Twig Default Filters

Hi, actually we have sent the bug report to [email protected] on 27th March 2023 and on 10th April 2023. Grav Server-side Template Injection SSTI via Twig Default Filters Summary: | Product | Grav CMS | | ----------------------- | --------------------------------------------- | | Vendor | Grav...

Grav Server Side Template Injection (SSTI) vulnerability

Summary I found an RCERemote Code Execution by SSTI in the admin screen. Details Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. PoC 1. Log in to the administrator screen and access the edit screen of the defaul...

Server-Side Template Injection leads to Remote Code Execution

Description Admin or Staff with "Mass mailer" permission can perform a Server-Side Template Injection attack Proof of Concept Log in as an admin or a staff who has "Mass mailer" permission, edit a message In the "Email content" field, insert the following value and click "Update and preview" %...

CVE-2023-34448

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke...

Design/Logic Flaw

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

CVE-2023-34448 Grav Server-side Template Injection (SSTI) via Twig Default Filters

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default filter function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke...

CVE-2023-34253 Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- 1 using unsafe functions that...

CVE-2023-34253 Grav vulnerable to Server-side Template Injection (SSTI) via Denylist Bypass

Grav is a flat-file content management system. Prior to version 1.7.42, the denylist introduced in commit 9d6a2d to prevent dangerous functions from being executed via injection of malicious templates was insufficient and could be easily subverted in multiple ways -- 1 using unsafe functions that...

CVE-2023-34252 Grav Server-side Template Injection via Insufficient Validation in filterFilter

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the GravExtension.filterFilter function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a...

CVE-2023-34252 Grav Server-side Template Injection via Insufficient Validation in filterFilter

Grav is a flat-file content management system. Prior to version 1.7.42, there is a logic flaw in the GravExtension.filterFilter function whereby validation against a denylist of unsafe functions is only performed when the argument passed to filter is a string. However, passing an array as a...

CVE-2023-34251 Grav Server Side Template Injection vulnerability

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

CVE-2023-34251

Grav (flat‑file CMS) versions before 1.7.42 are vulnerable to server‑side template injection (SSTI) that can enable remote code execution when a user with page editing privileges embeds malicious PHP on the administrator screen. The issue is mitigated by a fix in version 1.7.42. Public details in...

CVE-2023-34251 Grav Server Side Template Injection vulnerability

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

CVE-2023-34251 Grav Server Side Template Injection vulnerability

Grav is a flat-file content management system. Versions prior to 1.7.42 are vulnerable to server side template injection. Remote code execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges. Version 1.7.42 contains a fix for this...

Server-Side Template Injection

camaleoncms is vulnerable to Server-Side Template Injection. The vulnerability exists because the error messages in actions and upload functions at mediacontroller.rb are not properly sanitized, which allows an attacker to inject and execute arbitrary code with the output rendered...

Withdrawn Advisory: CraftCMS Server-Side Template Injection vulnerability

Withdrawn This advisory has been withdrawn because the CVE has been disputed and the underlying vulnerability is likely invalid. This link is maintained to preserve external references. According to maintainers of Craft CMS, only administrators can access Settings, and those administrators may ha...