CVE-2025-66297

Executive Summary

CVE-2025-66297 is a critical vulnerability in Grav CMS, a file-based web platform. The flaw allows an authenticated user with permissions to create or edit pages to inject malicious Twig expressions into page frontmatter. This enables privilege escalation to admin level and remote code execution (RCE) via the scheduler API. The vulnerability is fixed in version 1.8.0-beta.27. No public proof-of-concept code or exploit templates are currently available, but the risk is high due to the potential for full system compromise.

Supply Chain & Package Security

Grav CMS is a PHP-based application distributed via its official website and GitHub. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application logic. Users should verify the integrity of their Grav installation and ensure they are using the patched version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (admin panel access with page creation/edit permissions)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high privileges required reduce the base score, but the impact is severe as it allows full system compromise.

Deep Dive & Mechanics

Grav CMS uses Twig as its templating engine. Page frontmatter (YAML metadata) can be processed by Twig if the twig_first option is enabled. In vulnerable versions, a user with page creation/edit permissions can set twig_first: true in the frontmatter and inject malicious Twig expressions. These expressions are executed when the page is rendered.

The scheduler API in Grav allows execution of system commands. By combining Twig injection with the scheduler API, an attacker can execute arbitrary commands on the server. The attack flow is:

1. Authenticate to the Grav admin panel with a user that has page creation/edit permissions.
2. Create or edit a page and set twig_first: true in the frontmatter.
3. Inject a Twig expression that calls the scheduler API to execute a system command (e.g., {{ grav.scheduler.execute('id') }}).
4. Trigger the page rendering (e.g., by visiting the page or via a cron job).
5. The command executes, leading to privilege escalation or RCE.

Vulnerable vs. Patched Code

Vulnerable Code (prior to 1.8.0-beta.27): In system/src/Grav/Common/Page/Page.php, the twig_first option is processed without restrictions:

if ($this->header()->get('twig_first')) {
    $this->content = $this->twig->processString($this->content, $this->twig->getPageVariables());
}

Patched Code (1.8.0-beta.27): The patch restricts twig_first to admin users only and sanitizes the input:

if ($this->header()->get('twig_first') && $this->config->get('system.pages.twig_first')) {
    $this->content = $this->twig->processString($this->content, $this->twig->getPageVariables());
}

Additionally, the scheduler API now requires admin-level authentication for command execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to Grav admin panel with a user that has page creation/edit permissions.
• Target running Grav CMS version < 1.8.0-beta.27.

Exploitation Steps:

1. Login to the admin panel.
2. Create a new page or edit an existing one.
3. Set the frontmatter to include:

   ---
   title: Exploit
   twig_first: true
   ---
   

4. Inject malicious Twig in the page content:

   {{ grav.scheduler.execute('id') }}
   

5. Save and view the page to trigger execution.

Expected Output: The id command output will be displayed on the page or logged.

Blue Team

Detection Steps:

1. Monitor admin panel logs for unusual page creation or editing activity.
2. Check page frontmatter for twig_first: true in non-admin pages.
3. Review scheduler logs for unexpected command executions.
4. Look for Twig syntax in page content that is not typical for the site.

Hunting Query: Search for pages with twig_first set to true in the database or file system:

grep -r "twig_first: true" /path/to/grav/user/pages/

Indicators of Compromise (IOCs)

• File System: Presence of twig_first: true in page frontmatter files.
• Logs: Scheduler API calls with unexpected commands in logs/grav.log.
• Network: Outbound connections from the server to attacker-controlled hosts (if command execution leads to data exfiltration).
• Process: Unusual processes spawned by the web server user (e.g., id, whoami, curl).

Detection Engineering

YARA Rule

rule CVE_2025_66297_Twig_Injection {
    meta:
        description = "Detects Twig injection in Grav CMS page files"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66297"
    strings:
        $twig_first = "twig_first: true"
        $twig_exec = "{{ grav.scheduler.execute("
    condition:
        $twig_first and $twig_exec
}

Sigma Rule

title: Grav CMS Twig Injection via Scheduler API
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2025-66297 by monitoring scheduler API calls
author: Valters IT
date: 2025-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/admin/scheduler/execute'
        cs-uri-query: '*'
    condition: selection
falsepositives:
    - Legitimate admin scheduler usage
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66297 Grav CMS Twig Injection"; flow:to_server,established; content:"POST"; http_method; content:"/admin/scheduler/execute"; http_uri; content:"command"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Grav CMS version 1.8.0-beta.27 or later.
2. Restrict admin panel access to trusted users only.
3. Disable twig_first in system configuration if not needed:

   system:
     pages:
       twig_first: false
   

Long-term Measures:

• Implement strict input validation for page frontmatter.
• Use Web Application Firewall (WAF) rules to block Twig syntax in page content.
• Regularly audit user permissions and logs.

Valters IT – Securing your digital frontier.