CVE-2024-34082

描述

### Summary A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. ### Proof Of Concept `{{ read_file('/var/www/html/grav/user/accounts/riri.yaml') }}` Use the above Twig template syntax in a page and observe that the administrator riri's authentication details are exposed accessible by any unauthenticated user.  As an additional proof of concept for reading system files, observe the `/etc/passwd` file read using the following Twig syntax: `{{ read_file('/etc/passwd') }}`  ### Impact This can allow a low privileged user to perform a full account takeover of other registered users including Adminsitrators. This can also allow an adversary to read any file in the web server.

受影響套件(1)

• Packagist/getgrav/gravfrom 0, < 1.7.46

CVSS 分數

參考連結(4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-34082
• PATCHhttps://github.com/getgrav/grav
• WEBhttps://github.com/getgrav/grav/commit/b6bba9eb99bf8cb55b8fa8d23f18873ca594e348
• WEBhttps://github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69