CVE-2021-29440
HIGHGrav < 1.7.11 - Authenticated Remote Code Execution via Twig Template Injection
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-29440. PoCs published by enox, CsEnox.
AI-analyzed exploit summary This exploit demonstrates a Server-Side Template Injection (SSTI) vulnerability in Grav CMS 1.7.10, allowing authenticated users to execute arbitrary commands via Twig template injection. It authenticates, creates a malicious page with embedded system commands, and retrieves the output.
Description
Grav is a file based Web-platform. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. The issue was addressed in version 1.7.11.
Exploits (2)
This exploit demonstrates a Server-Side Template Injection (SSTI) vulnerability in Grav CMS 1.7.10, allowing authenticated users to execute arbitrary commands via Twig template injection. It authenticates, creates a malicious page with embedded system commands, and retrieves the output.
This repository contains a functional exploit for CVE-2021-29440, which leverages unsafe Twig processing in Grav CMS 1.7.10 to achieve remote code execution (RCE). The exploit automates authentication, page creation with malicious Twig templates, and command execution.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H