Resource Exhaustion in Grav CMS via Image Processing

Executive Summary

This vulnerability in Grav CMS versions 1.7.53 before 1.7.53.5 and 2.0.0-rc.8 before 2.2.2 allows anonymous visitors to bypass the system.images.max_pixels limit when system.images.url_actions is enabled. Attackers can exploit image URL parameters like forceResize, zoomCrop, or chained actions to force GD to allocate multi-gigabyte canvases, exhausting server memory and causing site downtime.

Useful 0 Not Useful 0

Detection Guidance

Check if system.images.url_actions is enabled in Grav CMS configuration files. Look for excessive memory usage or crashes during image processing requests. Monitor for large canvas allocations by inspecting URL parameters like forceResize, zoomCrop, or chained actions in server logs.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to server resource exhaustion with a single request, crashing the site and potentially affecting other processes on the host. It may cause downtime, degrade performance, and require manual intervention to restore services.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to denial-of-service conditions, causing service disruptions that may violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule §164.312). Uncontrolled resource exhaustion may also indicate insufficient security controls, potentially breaching compliance with data protection and security standards.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to versions 2.2.2 or 1.7.53.5 or later. Alternatively, disable system.images.url_actions in the configuration. Ensure the migrate-grav plugin is updated if used, as it may enable the vulnerable feature.

Useful 0 Not Useful 0