Stored XSS in Grav CMS via Shortcode Attributes

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in Grav CMS. It occurs in shortcode-core attribute handlers where XSS detection only checks for literal angle brackets. Attackers with admin.pages permission can inject malicious JavaScript via shortcode parameters that bypass validation. The payload executes in any viewer's browser, including administrators, enabling session hijacking through admin nonce theft.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS versions up to 6.2.1 for suspicious shortcode parameters in pages. Review admin.pages permission assignments. Look for unexpected JavaScript in rendered HTML attributes like onmouseover. Use web application firewalls to log and block unusual shortcode patterns.

Useful 0 Not Useful 0

Impact Analysis

An attacker could steal session cookies or admin nonces, allowing them to hijack sessions and perform actions with elevated privileges. The injected script executes in the browser of any user viewing the compromised page, including administrators, potentially leading to full system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations using vulnerable Grav versions may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to the latest version if available. Remove admin.pages permissions from untrusted users. Implement strict input validation for shortcode attributes. Use output encoding for all dynamic content. Monitor for unauthorized page edits or script injections.

Useful 0 Not Useful 0