Grav Willkürliches Lesen von Dateien zur Übernahme von Konten

The primary impact of CVE-2024-34082 lies in the exposure of sensitive server files. An attacker exploiting this vulnerability can read user account files located at /grav/user/accounts/*.yaml. These files contain hashed user passwords, two-factor authentication (2FA) secrets, and password reset tokens. Successful compromise allows an adversary to reset user passwords, gain access to 2FA secrets, and ultimately take over user accounts. Furthermore, the ability to read arbitrary server files opens the door to broader data exfiltration and potential system compromise, depending on the files accessible on the server. This vulnerability shares similarities with other Twig template engine vulnerabilities where improper input sanitization allows for file path manipulation.

Organizations and individuals using Grav CMS versions prior to 1.7.46 are at risk. This includes websites and applications that rely on Grav CMS for content management. Shared hosting environments where multiple users have page edit privileges are particularly vulnerable, as a compromised account could potentially expose data for other users on the same server.

• linux / server:

journalctl -u grav | grep -i "twig"

• generic web:

curl -I https://your-grav-site.com/grav/user/accounts/*.yaml # Check for file listing

• wordpress / composer / npm: (Not applicable, Grav is not based on these technologies) • database (mysql, redis, mongodb, postgresql): (Not applicable, this is a file access vulnerability) • windows / supply-chain: (Not applicable, Grav is not a Windows application)

1. 2024-05-15Disclosure

   disclosure

1. Reserviert2024-04-30
2. Veröffentlicht2024-05-15
3. Geändert2024-08-02
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-34082 is to upgrade Grav CMS to version 1.7.46 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. Restrict access to the /grav/user/accounts/ directory using web server configuration (e.g., .htaccess for Apache, nginx configuration). Review and harden Twig template configurations to prevent arbitrary code execution. Monitor Grav CMS logs for suspicious activity, particularly attempts to access files outside of expected locations. After upgrading, confirm the fix by attempting to access the /grav/user/accounts/*.yaml files with a low-privilege user account; access should be denied.