CVE-2024-28116
Published: 21 March 2024
Summary
CVE-2024-28116 is a high-severity Code Injection (CWE-94) vulnerability in Getgrav Grav. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 1.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Grav is an open-source flat-file content management system affected by a server-side template injection vulnerability in versions prior to 1.7.45. The flaw, tracked under CWE-94 and CWE-1336, permits an authenticated user to inject and execute arbitrary code on the server by bypassing the existing security sandbox, resulting in a CVSS 3.1 score of 8.8.
Any user holding at least editor permissions can exploit the issue over the network without user interaction to achieve full code execution, compromising confidentiality, integrity, and availability of the remote server.
The official GitHub Security Advisory GHSA-c9gp-64c4-2rrh and accompanying commits document the patch that was merged into version 1.7.45; administrators are advised to upgrade immediately to close the injection path.
The EPSS score for this CVE stands at 0.6217 with no indicated rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-0899
Vulnerability details
Grav is an open-source, flat-file content management system. Grav CMS prior to version 1.7.45 is vulnerable to a Server-Side Template Injection (SSTI), which allows any authenticated user (editor permissions are sufficient) to execute arbitrary code on the remote server bypassing…
more
the existing security sandbox. Version 1.7.45 contains a patch for this issue.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.