File Upload Extension Bypass in Grav API Plugin

Executive Summary

This vulnerability is a file upload extension bypass in the Grav CMS API Media Controller. It allows authenticated users with the api.media.write permission to upload files with double extensions like shell.php.jpg. The system only checks the final extension (.jpg) and misses the hidden .php part. The web server may execute the file as PHP, leading to remote code execution.

Useful 0 Not Useful 0

Impact Analysis

An attacker could upload a malicious PHP file disguised as an image. If the server executes PHP files within images, it could lead to remote code execution on the server. Even if PHP execution is blocked, the source code may be exposed, revealing sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may expose personal or health information, resulting in legal and regulatory penalties.

Useful 0 Not Useful 0

Detection Guidance

• Check Grav CMS versions: Run `composer show getgrav/grav-plugin-api` to verify if the installed version is below 1.0.3.
• Inspect uploaded files: Look for files with double extensions like .php.jpg or similar patterns in media directories.
• Review API media controller logs: Check server logs for unauthorized file upload attempts to the API media endpoint.
• Validate file extensions: Use commands like `find /path/to/media -type f -name '*.php.*' -o -name '*.phtml.*'` to detect suspicious files.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade the Grav API plugin: Update to version 1.0.3 or later using `composer update getgrav/grav-plugin-api`.
• Disable dangerous extensions: Ensure the blocklist includes all executable extensions like .php, .phtml, .phar, etc.
• Validate full filenames: Modify the extension validation logic to check all parts of the filename, not just the last extension.
• Restrict api.media.write permission: Limit this permission to trusted users only.
• Scan for malicious files: Use tools like `clamav` or `rkhunter` to scan media directories for suspicious files.

Useful 0 Not Useful 0