Server-Side Template Injection in Grav CMS

Executive Summary

Grav CMS before version 2.0.13 has a server-side template injection flaw in its Twig engine. Low-privileged page editors can inject unsandboxed Twig payloads using the find filter in email-action fields like subject, body, to, or from. This allows arbitrary operating-system command execution when forms are submitted.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS version with: grep -r 'version' /path/to/grav/vendor/getgrav/grav/CHANGELOG.md. If version is below 2.0.13, the system is vulnerable. Inspect email-action forms for Twig syntax in subject, body, to, or from fields. Monitor server logs for unusual command execution patterns or unsandboxed Twig filter usage.

Useful 0 Not Useful 0

Impact Analysis

Attackers with low privileges can execute arbitrary OS commands on the server. This could lead to full server takeover, data theft, or system compromise. The attack requires minimal privileges and can be triggered by submitting a form, even without a working mail server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Grav CMS to version 2.0.13 or later immediately. Disable the Email plugin if not required. Restrict page editor privileges to minimum necessary. Apply sandboxing to email-action parameters by modifying Grav's Twig configuration. Monitor for suspicious activity in form submissions and server logs.

Useful 0 Not Useful 0