Exploitation of Grav CMS SSTI Vulnerabilities

Recent exploits targeting Grav CMS have emerged, leveraging the SSTI vulnerability (CVE-2024-28116). Two proof-of-concept scripts, GenGravSSTIExploit and Graver, allow attackers to inject remote code execution (RCE) payloads on vulnerable systems. These scripts require valid user credentials for authentication, indicating that the attacks are more targeted. The exploits can create malicious pages on affected servers, enabling attackers to execute arbitrary commands. Grav CMS versions affected include those prior to the patch for CVE-2024-28116. The tools are available on GitHub, raising concerns about potential misuse. Security professionals are advised to monitor their systems and apply necessary patches. The situation is evolving, with potential for increased exploitation as awareness grows.

Key Points: • Grav CMS is vulnerable to SSTI and RCE exploits (CVE-2024-28116). • Two PoC scripts, GenGravSSTIExploit and Graver, are publicly available. • Exploitation requires valid user credentials, indicating targeted attacks.