As3617

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 1.7.45 **Description** Grav is an open-source, flat-file content management system. The issue arises because Grav validates accessible functions through the `Utils::isDangerousFunction` function but does not impose restrictions on twig functions like `twig array map`, allowing attackers to bypass the validation and execute arbitrary commands. Twig processing of static pages can be enabled in the front matter by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. **Recommendations** For Grav versions prior to 1.7.45, upgrade to the patched version 1.7.45 to mitigate this issue. As a temporary workaround, consider restricting access to the `twig array map` function and disabling unsandboxed Twig processing for static pages until the patch is applied. Avoid using the `call user func` function in conjunction with `twig array map` to prevent arbitrary code execution.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 1.7.45 **Description** The issue arises due to unrestricted access to the twig extension class from the Grav context, allowing an attacker to redefine config variables and bypass previous SSTI mitigation. This can lead to arbitrary code execution and privilege elevation on the instance. The Twig processor runs unsandboxed, and its processing of static pages can be enabled by any administrative user allowed to create or edit pages. **Recommendations** For Grav versions prior to 1.7.45, update to version 1.7.45 or later to resolve the issue. As a temporary workaround, consider disabling the Twig processor for static pages or restricting access to the twig extension class to minimize the risk of exploitation. Avoid using the `registerUndefinedFunctionCallback` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 1.7.45 **Description** The issue arises from unrestricted access to the twig extension class from the grav context, allowing an attacker to redefine the escape function and execute arbitrary commands. This can be achieved by enabling Twig processing of static pages in the front matter, which can be done by any administrative user allowed to create or edit pages. As the Twig processor runs unsandboxed, this behavior can be used to gain arbitrary code execution and elevate privileges on the instance. **Recommendations** For Grav versions prior to 1.7.45, update to version 1.7.45 or later to resolve the issue. As a temporary workaround, consider restricting access to the Twig processor or disabling the ability to enable Twig processing of static pages in the front matter until a patch is applied. Avoid using the `setEscaper` method in the `grav.twig.twig.extensions.core` class to redefine the escape function, as this can be used to execute arbitrary commands.