CVE-2025-66299

Executive Summary

CVE-2025-66299 is a critical Server-Side Template Injection (SSTI) vulnerability in Grav CMS, a file-based web platform. The flaw allows any authenticated user with editor-level permissions to bypass the built-in Twig security sandbox and execute arbitrary code on the remote server. The vulnerability stems from the sandbox not fully protecting the Twig environment object, enabling attackers to call methods and modify attributes through malicious Twig directives. By injecting crafted templates into a web page, an editor can add arbitrary functions to the system.twig.safe_filters attribute, effectively disabling the sandbox. This leads to full remote code execution (RCE). The vulnerability is fixed in version 1.8.0-beta.27. Given the high CVSS score of 8.8 and the potential for complete server compromise, immediate patching is critical.

Supply Chain & Package Security

Grav CMS is a PHP-based application distributed via its official website and GitHub. The vulnerability exists in the core Twig integration, not in a third-party package. However, any custom plugins or themes that extend Twig functionality could be affected. Users should verify that no custom code relies on the vulnerable sandbox behavior.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated editor)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The low attack complexity and low privileges required make this vulnerability highly exploitable. An authenticated editor can achieve full RCE without any user interaction.

Deep Dive & Mechanics

The vulnerability lies in the Twig sandbox implementation within Grav CMS. The sandbox is intended to restrict the use of dangerous Twig features (e.g., sort, filter, map) by blocking access to the Twig environment object. However, the sandbox does not fully protect the Twig\Environment instance. An attacker can exploit this by injecting Twig template directives that interact with the environment object directly.

The core issue is that the sandbox allows access to the system.twig.safe_filters attribute. By crafting a malicious Twig template, an attacker can call methods on the environment object to add arbitrary PHP functions to the safe_filters list. Once a function is marked as safe, it can be used in Twig templates without restriction, effectively bypassing the sandbox.

For example, an attacker could add system or exec to the safe filters, then use them in a template to execute arbitrary shell commands. The attack flow is:

1. Authenticate as an editor.
2. Create or edit a page with a malicious Twig template.
3. The template uses Twig syntax to access the environment object and modify system.twig.safe_filters.
4. The template then calls the newly added safe filter to execute code.

Vulnerable vs. Patched Code

Vulnerable Code (Grav < 1.8.0-beta.27): The sandbox configuration in system/src/Grav/Common/Twig/Extension/GravExtension.php or similar files does not block access to the Twig environment object. The safe_filters attribute is writable.

// Vulnerable: The sandbox allows access to the environment object
$twig->addExtension(new SandboxExtension($sandboxPolicy, true));
// The sandbox policy does not restrict access to 'system.twig.safe_filters'

Patched Code (Grav >= 1.8.0-beta.27): The patch hardens the sandbox by explicitly blocking access to the Twig environment object and preventing modification of safe_filters.

// Patched: The sandbox now blocks access to the environment object
$sandboxPolicy = new SandboxPolicy();
$sandboxPolicy->setAllowedMethods(['__construct' => false]); // Block all methods on Environment
$sandboxPolicy->setAllowedProperties(['safe_filters' => false]); // Block write access
$twig->addExtension(new SandboxExtension($sandboxPolicy, true));

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Grav CMS instance running version < 1.8.0-beta.27.
• An authenticated user account with editor permissions.

Exploitation Steps:

1. Authenticate to the Grav admin panel.
2. Create a new page or edit an existing one.
3. Inject the following Twig template into the page content:

{% set env = grav.twig.environment %}
{% do env.addFilter('system', {is_safe: ['all']}) %}
{{ 'id'|system }}

4. Save the page and view it. The output will show the result of the id command, confirming RCE.

Alternative Payload (using safe_filters):

{% do grav.twig.environment.mergeGlobals({'system': {'twig': {'safe_filters': ['system']}}}) %}
{{ system('whoami') }}

Note: The exact syntax may vary depending on the Grav version. The key is to access the Twig environment object and modify the safe filters.

Blue Team (Detection & Response)

Detection:

• Monitor for unusual Twig template content in page edits, especially templates containing environment, safe_filters, or addFilter.
• Look for HTTP requests to the admin panel with POST data containing Twig syntax.
• Check server logs for unexpected command execution (e.g., id, whoami, cat /etc/passwd).

Response:

• Immediately isolate the affected server.
• Review all pages created or edited by the compromised user.
• Rotate all credentials and API keys.
• Apply the patch by upgrading to Grav 1.8.0-beta.27 or later.

Indicators of Compromise (IOCs)

• File-based IOCs:
  • Presence of Twig templates containing environment, safe_filters, or addFilter in page content.
  • Unexpected files in the user/pages/ directory with malicious Twig code.
• Network IOCs:
  • HTTP POST requests to /admin with payloads containing {{ and }} Twig syntax.
  • Outbound connections from the web server to unknown IPs (possible reverse shell).
• System IOCs:
  • Unusual processes spawned by the web server user (e.g., id, whoami, bash).
  • Modified system.yaml or twig.yaml configuration files.

Detection Engineering

YARA Rule

rule CVE_2025_66299_Grav_SSTI {
    meta:
        description = "Detects malicious Twig templates exploiting CVE-2025-66299 in Grav CMS"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $twig_env = /grav\.twig\.environment/i
        $safe_filters = /safe_filters/i
        $addFilter = /addFilter/i
        $system_call = /system\(/
    condition:
        all of ($twig_env, $safe_filters, $addFilter) or ($twig_env and $system_call)
}

Sigma Rule

title: CVE-2025-66299 Grav CMS SSTI Exploitation
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit SSTI in Grav CMS by modifying Twig safe filters
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: '/admin'
        cs-request-body|contains:
            - 'grav.twig.environment'
            - 'safe_filters'
            - 'addFilter'
    condition: selection
falsepositives:
    - Legitimate admin activity (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66299 Grav CMS SSTI Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/admin"; http_uri; content:"grav.twig.environment"; http_client_body; content:"safe_filters"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Grav CMS to version 1.8.0-beta.27 or later.
2. Review all user accounts with editor permissions and revoke access for any suspicious accounts.
3. Audit all pages for malicious Twig templates.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block requests containing grav.twig.environment or safe_filters in POST data.
• Restrict editor permissions to trusted users only.
• Enable logging of all admin panel actions.
• Regularly update Grav CMS and its dependencies.

Workaround (if patching is not immediately possible):

• Disable the Twig sandbox entirely (not recommended) or restrict editor access to only trusted users.
• Use a reverse proxy to inspect and block malicious payloads.

Valters IT
Securing Digital Frontiers