Grav CMS Twig Sandbox Session Cookie Steal and Cache Replay Vulnerability

Vulnerability Summary Overview Title: Editor-authored Twig can read the administrator's session cookie, and the shared page content cache replays it to anonymous visitors. Severity: High (CVSS 8.0) Description: Grav allows editor-authored Twig code to be executed within a sandbox. This sandbox permits the function to read any cookie value, including the session cookie of the current request. Furthermore, Grav stores processed output in a shared page content cache based on page identity and configuration hash. This cache does not differentiate between sessions, users, or request identities. An attacker can create a public page that captures the session identifier of an administrator visiting the page subsequently, and replays it to an unauthenticated attacker in later requests. Replaying this cookie authenticates the attacker as an administrator. Scope Affected Versions: 2.0.19 to 2.0.24: Vulnerable under default configuration. 2.0.0 to 2.0.18 and 1.7.x: Vulnerable only when is explicitly enabled. Affected Package: (Composer) Attack Vector: Network Required Privileges: Low (requires an account with page editing permissions) Impact: Low-privileged page authors can obtain valid, authenticated administrator session identifiers. Attackers can use these credentials to perform actions as an administrator, including accessing protected API endpoints. Victims are compromised simply by a normal page view, requiring no specific action. Remediation Fixed Version: 2.0.25 Fix Details: 1. Removed from the whitelist of the Twig content sandbox. 2. Pages rendering editor-authored are no longer stored in the shared cache. Workarounds: Set either of the following configuration items to break the attack chain: Subsequently, run to clear the contaminated cache entries and rotate administrator sessions. POC / Exploit Code 1. Create Malicious Page (via API) 2. Trigger Vulnerability (Admin Access) An administrator visits the page (e.g., ). The page content, including the administrator's session cookie, is written to the shared cache. 3. Retrieve Cookie (Anonymous Access) An anonymous visitor accesses the same page to retrieve the administrator's session cookie stored in the cache. 4. Exploit Cookie Use the captured cookie to access a protected administrator endpoint.

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS Twig Sandbox Session Cookie Steal and Cache Replay Vulnerability

More from this source