Summary
A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.
Proof Of Concept
{{ read_file('/var/www/html/grav/user/accounts/riri.yaml') }}
Use the above Twig template syntax in a page and observe that the administrator riri's authentication details are exposed accessible by any unauthenticated user.
As an additional proof of concept for reading system files, observe the /etc/passwd file read using the following Twig syntax:
{{ read_file('/etc/passwd') }}
Impact
This can allow a low privileged user to perform a full account takeover of other registered users including Adminsitrators. This can also allow an adversary to read any file in the web server.
References
richighimi Reporter
Summary
A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.
Proof Of Concept
{{ read_file('/var/www/html/grav/user/accounts/riri.yaml') }}Use the above Twig template syntax in a page and observe that the administrator riri's authentication details are exposed accessible by any unauthenticated user.
As an additional proof of concept for reading system files, observe the
/etc/passwdfile read using the following Twig syntax:{{ read_file('/etc/passwd') }}Impact
This can allow a low privileged user to perform a full account takeover of other registered users including Adminsitrators. This can also allow an adversary to read any file in the web server.
References