CVE-2023-34448

moderate-risk
Published 2023-06-14

Grav is a flat-file content management system. Prior to version 1.7.42, the patch for CVE-2022-2073, a server-side template injection vulnerability in Grav leveraging the default `filter()` function, did not block other built-in functions exposed by Twig's Core Extension that could be used to invoke arbitrary unsafe functions, thereby allowing for remote code execution. A patch in version 1.74.2 overrides the built-in Twig `map()` and `reduce()` filter functions in `system/src/Grav/Common/Twig/Extension/GravExtension.php` to validate the argument passed to the filter in `$arrow`.

Do I need to act?

~
8.8% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (1)

Affected Vendors

Getgrav

References (10)

Patch https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8
Vendor Advisory https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8
Vendor Advisory https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148
Exploit https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/
Exploit https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfe...
Patch https://github.com/getgrav/grav/commit/8c2c1cb72611a399f13423fc6d0e1d998c03e5c8
Vendor Advisory https://github.com/getgrav/grav/security/advisories/GHSA-whr7-m3f8-mpm8
Vendor Advisory https://github.com/twigphp/Twig/blob/v1.44.7/src/Environment.php#L148
Exploit https://huntr.dev/bounties/3ef640e6-9e25-4ecb-8ec1-64311d63fe66/
Exploit https://www.github.com/getgrav/grav/commit/9d6a2dba09fd4e56f5cdfb9a399caea355bfe...
45
/ 100
moderate-risk
Severity 30/34 · Critical
Exploitability 10/34 · Low
Exposure 5/34 · Minimal