Grav CMS Session Hijacking via Twig Sandbox Injection

Grav CMS versions 1.7.x and 2.0.0 through 2.0.24 contain a vulnerability in the Twig sandbox configuration. Specifically, the get_cookie() function is allowlisted for use within page content. A user with page-write permissions can inject Twig template code to read arbitrary browser cookies from any user who visits the crafted page. This attack bypasses standard security protections such as the HttpOnly, Secure, and SameSite attributes because the extraction occurs server-side.

The vulnerability is compounded by the Grav page-content caching mechanism, which stores the processed output of Twig-enabled pages without scoping the cache to the viewing user's session or identity. When an administrator views the crafted page, their session cookie is captured and embedded into the cached version of the content. Subsequent unauthenticated visitors to that page receive the cached content containing the administrator's session identifier. This allows unauthorized attackers to replay the stolen session cookie to hijack administrative access. In version 2.0.19 and later, Twig content processing is enabled by default, increasing the exploit surface. The issue was addressed in version 2.0.25.

Attack Chain

1. An attacker obtains or registers a user account with page-write privileges on the target Grav CMS.
2. The attacker navigates to the administrative interface to create or edit a page.
3. The attacker injects malicious Twig code containing {{ get_cookie('session_cookie_name') }} into the page content.
4. The attacker saves the page, triggering the server to render the Twig code during the next page load.
5. An administrator visits the crafted page, causing the server to execute the injected code and extract the administrator's session cookie.
6. The server stores the resulting rendered output in the system's global page cache, including the captured sensitive cookie data.
7. The attacker or another unauthenticated user requests the crafted page and receives the cached content containing the administrator's session token.
8. The attacker uses the intercepted session token to impersonate the administrator and gain unauthorized administrative control.

Impact

Successful exploitation allows for complete administrative account takeover of the Grav CMS instance. This can lead to unauthorized modification of site content, configuration changes, and potential remote code execution depending on the privileges and plugins associated with the hijacked administrative session. The scope includes all Grav deployments running vulnerable versions where Twig content rendering is enabled.

Recommendation

• Upgrade Grav CMS to version 2.0.25 or later immediately.
• Audit all pages authored by users with page-write permissions for the presence of Twig syntax or suspicious template code.
• Disable Twig content processing if it is not required for site functionality by setting security.twig_content.process_enabled to false.
• Review administrative access logs for unusual session activity or successful logins originating from disparate IP addresses following the period of exposure.