Grav CMS Flex Blueprint Arbitrary Code Execution Vulnerability and Patch Details

Vulnerability Overview This vulnerability involves callable directives hidden within the Blueprint field of the Flex directory. This flaw allows attackers to execute dangerous functions in Flex pages, Flex users, and Flex objects by utilizing dynamic field data, thereby bypassing the security guards added to page forms in version 2.0.7. Affected Scope Flex Pages: Attackers can execute dangerous functions via dynamic field data. Flex Users: Similarly, there is a risk of executing dangerous functions. Flex Objects: Also exhibit similar security issues. Remediation Steps 1. Update Version: Upgrade to version 2.0.8, which addresses the aforementioned security issues. 2. Code Modifications: - In , the method was added to check whether a function is safe. - In , the method was added to handle special characters. - In , the method was added to handle webhook triggers. - In , the method was added to handle webhook requests. - In , the method was added to handle dynamic data fields. - In , the class was added to test the dynamic data call guard. POC Code `` ![My image.jpg] ! [label] `. if (preg_match('/^(?:!)?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}?\{[^\}]+\}

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS Flex Blueprint Arbitrary Code Execution Vulnerability and Patch Details

More from this source