CVE-2024-28117: Server Side Template Injection (SSTI)

March 22, 2024 (updated January 3, 2025)

Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twig_array_map, allowing attackers to bypass the validation and execute arbitrary commands.

References

github.com/advisories/GHSA-qfv4-q44r-g7rv
github.com/getgrav/grav
github.com/getgrav/grav/commit/de1ccfa12dbcbf526104d68c1a6bc202a98698fe
github.com/getgrav/grav/security/advisories/GHSA-qfv4-q44r-g7rv
nvd.nist.gov/vuln/detail/CVE-2024-28117

Code Behaviors & Features

Detect and mitigate CVE-2024-28117 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →