Grav CMS Configuration Array Exposure via Twig Sandbox

Executive Summary

Grav CMS before version 2.0.16 has a flaw where system, site, and theme configuration arrays are not properly filtered in sandboxed Twig renders. This allows content editors with page-content edit access to read sensitive configuration values, including secrets like cache credentials, by using dot notation in Twig templates. The vulnerability bypasses the config_denied_paths restrictions because the sandbox security policy cannot restrict array key access, only object method and property access.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS version with: grep -r "version" /path/to/grav/vendor/composer/installed.json. If version is below 2.0.16, the system is vulnerable. Inspect Twig templates for suspicious dot notation usage like {{ system.cache.redis.password }} in page content.

Review logs for unauthorized access attempts to configuration paths. Monitor for unusual template rendering errors that may indicate sandbox bypass attempts.

Useful 0 Not Useful 0

Impact Analysis

If you are a Grav CMS user with page-content edit access, an attacker could exploit this to read sensitive configuration data, including credentials for caches or other services. This could lead to unauthorized access to system resources, data breaches, or further compromise of the CMS environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized exposure of sensitive data, such as credentials or configuration details, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Unauthorized access to such data could result in regulatory penalties or legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 2.0.16 or later immediately. Apply the patch from the official Grav CMS repository or use the provided security advisory fixes.

Restrict page-content edit access to trusted users only. Review and remove any existing Twig templates using dot notation to access system, site, or theme variables.

Rotate all exposed credentials including cache passwords and API keys. Monitor system logs for any signs of exploitation attempts after mitigation.

Useful 0 Not Useful 0