CVE-2025-66844

Executive Summary

CVE-2025-66844 is a Server-Side Request Forgery (SSRF) vulnerability affecting Grav CMS versions prior to 1.7.49.5. The flaw resides in the Twig templating engine integration, where page content processed by Twig can be manipulated to register and call arbitrary undefined PHP functions. This allows an attacker to craft malicious requests that force the server to make internal or external HTTP requests, potentially accessing sensitive internal services, cloud metadata endpoints, or performing port scanning. The vulnerability requires that the Grav configuration allows undefined PHP functions to be registered, which is a non-default but possible configuration. No public proof-of-concept (PoC) or exploit code has been released at this time.

Supply Chain & Package Security

Grav is a flat-file CMS distributed as a PHP package via Composer. The vulnerability is not in a third-party library but in Grav's core Twig integration. The supply chain risk is low, as the fix is a configuration hardening within Grav itself. However, administrators should verify that no custom plugins or themes rely on the vulnerable Twig function registration behavior.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) / Estimated: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High (potential access to internal services)
• Integrity Impact: Low (limited ability to modify internal state)
• Availability Impact: None

Threat Level: High. The SSRF can be exploited without authentication, and the impact on confidentiality is significant, as it can expose internal network services and cloud metadata.

Deep Dive & Mechanics

The vulnerability is rooted in Grav's Twig environment configuration. When processing page content, Grav uses Twig to render templates. If the configuration option twig.config.undefined_functions is set to allow registration of undefined PHP functions, an attacker can inject Twig syntax that calls arbitrary PHP functions. Specifically, the registerUndefinedFunctionCallback mechanism in Twig can be abused to call functions like file_get_contents, curl_exec, or other network-related PHP functions.

The attack flow:

1. An attacker with the ability to create or modify page content (e.g., via a compromised admin account or a plugin that allows content injection) inserts a Twig expression such as {{ function('file_get_contents', 'http://internal-service/admin') }}.
2. Grav's Twig engine processes this template, and because undefined functions are allowed, it calls file_get_contents with the attacker-controlled URL.
3. The server makes an HTTP request to the internal service, and the response is rendered in the page output, leaking sensitive data.

The vulnerability is particularly dangerous in cloud environments where metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/) are accessible.

Vulnerable vs. Patched Code

Vulnerable Code (Grav < 1.7.49.5): In system/src/Grav/Common/Twig/Twig.php, the Twig environment is configured with:

$twig->registerUndefinedFunctionCallback(function ($name) {
    return function (...$args) use ($name) {
        return call_user_func_array($name, $args);
    };
});

This allows any PHP function to be called from Twig templates.

Patched Code (Grav >= 1.7.49.5): The patch removes or restricts the registerUndefinedFunctionCallback to only allow a whitelist of safe functions, or disables it entirely. The patched code might look like:

// No undefined function callback registered
// Or a restricted callback that only allows safe functions
$twig->registerUndefinedFunctionCallback(function ($name) {
    $allowed = ['strtoupper', 'strtolower', 'ucfirst'];
    if (in_array($name, $allowed)) {
        return function (...$args) use ($name) {
            return call_user_func_array($name, $args);
        };
    }
    return null;
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to create or modify page content in Grav (e.g., admin credentials or a vulnerable plugin).
• Grav configuration must have twig.config.undefined_functions enabled (non-default).

Exploitation Steps:

1. Create a new page or edit an existing one with the following Twig payload:

   {{ function('file_get_contents', 'http://169.254.169.254/latest/meta-data/') }}
   

2. Save the page and view it. The response will contain the cloud metadata.
3. For internal network scanning, use:

   {{ function('file_get_contents', 'http://192.168.1.1/admin') }}
   

Lab Setup:

• Install Grav 1.7.49.4 or earlier.
• Enable undefined functions in user/config/system.yaml:

  twig:
    config:
      undefined_functions: true
  

• Set up a simple internal service (e.g., a Python HTTP server on port 8080) to simulate the target.

Blue Team

Detection:

• Monitor for unusual HTTP requests originating from the Grav server to internal IPs or cloud metadata endpoints.
• Look for Twig template content containing function( calls in page content or logs.
• Use the Sigma rule below to detect attempts.

Hunting:

• Search web server logs for requests to pages that contain {{ function( in the body.
• Review Grav logs for errors related to undefined function calls.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests from the Grav server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata IPs (169.254.169.254).
• File: Page content containing Twig expressions like {{ function('file_get_contents', ...) }} or {{ function('curl_exec', ...) }}.
• Log: Grav system logs showing Twig_Error_Syntax or UndefinedFunction errors.
• Process: PHP processes making unexpected network connections (check with netstat or lsof).

Detection Engineering

YARA Rule

rule CVE_2025_66844_SSRF_Twig {
    meta:
        description = "Detects Twig templates attempting SSRF via undefined function calls"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66844"
    strings:
        $twig_func = /{{\s*function\s*\(\s*['"](?:file_get_contents|curl_exec|fopen|fsockopen)['"]\s*,/
        $twig_ssrf = /{{\s*function\s*\(.*http[s]?:\/\//
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-66844 Grav SSRF via Twig
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests from Grav server to internal IPs or cloud metadata endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '169.254.169.254'
            - '10.'
            - '172.16.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate internal monitoring tools
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-66844 Grav SSRF Attempt"; flow:to_server; content:"function("; http_client_body; nocase; content:"file_get_contents"; http_client_body; nocase; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Grav to version 1.7.49.5 or later.
2. If upgrade is not possible, disable the twig.config.undefined_functions option in user/config/system.yaml:

   twig:
     config:
       undefined_functions: false
   

3. Restrict outbound network access from the Grav server using firewall rules (e.g., block access to internal IP ranges and cloud metadata endpoints).

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) rule to block Twig expressions containing function( in POST/GET parameters.
• Regularly audit Grav configurations and plugins for insecure settings.
• Monitor for new CVEs related to Grav and apply patches promptly.

Valters IT
Securing your digital frontier.