Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 2.0.16 |
Miggo AIRoot Cause AnalysisThe vulnerability (GHSA-p597-crqc-m349) in Grav CMS before 2.0.16 allowed information disclosure due to improper filtering of system, site, and theme configuration arrays in sandboxed Twig renders. The core issue was that the Twig sandbox's SecurityPolicy does not restrict array key access, and these sensitive arrays were passed directly into the sandboxed environment without being wrapped in a filtering facade like SandboxConfig.
Analysis of the patch (commit 6d37af2f50e59d014401c0e5982bdbfc32a20a67) reveals that the Grav\Common\Twig\Twig::processPage() and Grav\Common\Twig\Twig::processString() functions were the points where the unfiltered variables were introduced into the sandboxed Twig context. Before the patch, these functions would copy the raw $twig_vars (which contained the sensitive system, site, and theme arrays) into the $sandbox_vars or $vars without applying the necessary filtering. The patch introduces a new private function, buildSandboxVars, which is now called by both processPage and processString to ensure that system, site, and theme variables are also filtered using the config_denied_paths list before being made available in the sandboxed Twig environment. Therefore, the vulnerability existed in the logic of processPage and processString prior to this change, as they were responsible for setting up the sandboxed variables incorrectly.
Grav\Common\Twig\Twig.processPagesystem/src/Grav/Common/Twig/Twig.php
Grav\Common\Twig\Twig.processStringsystem/src/Grav/Common/Twig/Twig.php