CVE-2023-34252

Summary

CVE-2023-34252 is a logic flaw affecting the Grav content management system before version 1.7.42. The issue lies in the `GravExtension.filterFilter()` function, where validation against a denylist of unsafe functions is bypassed when an array is passed as a callable argument instead of a string. This allows a low-privileged attacker with access to the Grav Admin panel and page creation/update permissions to inject malicious templates and achieve remote code execution. The vulnerability resides in the `GravExtension.filterFilter()` function declared in `/system/src/Grav/Common/Twig/Extension/GravExtension.php`. Grav users are recommended to update to version 1.7.42 to apply the patch and set `twig.undefined_functions` and `twig.undefined_filters` properties to `false` in the `/path/to/webroot/system/config/system.yaml` configuration file to prevent Twig from executing undefined functions or filters.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.