Grav CMS: Twig Sandbox Bypass via sort() leading to RCE (v<=2.0.17)

Vulnerability Overview Title: passes , allowing the page editor to invoke arbitrary PHP functions through the Twig sandbox. CVE ID: None (No known CVE) Severity: High Affected Versions: Fixed in: Root Cause: In , calls with hardcoded, bypassing the Twig sandbox's restrictions on non-closure functions, allowing an attacker (such as a user with page editor privileges) to execute arbitrary PHP functions. Impact Scope Affected Component: (Composer package) Affected Versions: (HEAD commit ) Attack Surface: Users with page editing permissions (roles such as , ) can trigger arbitrary PHP function execution via mechanisms like , achieving remote code execution (RCE). Remediation Fixed in: Fix Details: Modified by replacing the hardcoded with a dynamically resolved sandbox status based on the environment, ensuring correctly rejects non-closure functions in sandbox mode. Related PR: (Fix PR) PoC / Exploit Code ``` policy.allowFilters count=196 sort:true raw:false => sanity: the sandbox really is the shipped policy :) [raw] => BLOCKED: Function "raw" is not allowed in "@Page:/user/pages/01_home" at line 1. read_file] => BLOCKED: Function "read_file" is not allowed in "@Page:/user/pages/01_home" at line 1. count] => RENDERED: 12 --- map with string callable RESULT: BLOCKED -> The callable passed to the "map" filter must be a Closure in sandbox mode --- filter with string callable RESULT: BLOCKED -> The callable passed to the "filter" filter must be a Closure in sandbox mode --- sort with string callable RESULT: RENDERED -> pg sort(string-callable under @evalVar: -> ok :)) sort(string-callable under @evalVar: -> ok :)) map (string-callable under @evalVar: -> err :)) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS: Twig Sandbox Bypass via sort() leading to RCE (v<=2.0.17)

More from this source