Grav API Plugin Configuration Write Access Flaw

Executive Summary

This vulnerability affects Grav API Plugin versions before 1.0.10. It allows authenticated users with the api.config.write privilege to modify security-critical settings like rate limiting and CORS policies without proper authorization checks. Attackers can disable rate limiting to enable brute-force attacks on credentials and reconfigure CORS to include malicious origins with credentials enabled.

Useful 0 Not Useful 0

Detection Guidance

Check Grav API plugin version with: composer show grav/api-plugin. If version is before 1.0.10, the system is vulnerable. Inspect API logs for PATCH requests to /api/v1/config/plugins/api that modify rate limiting or CORS settings.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to disable site-wide rate limiting, making it easier to perform credential brute-forcing attacks on API keys, passwords, or tokens. They could also modify CORS policies to include attacker-controlled domains, potentially enabling session hijacking or unauthorized data access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Disabling rate limiting may allow brute-force attacks that compromise user credentials, while CORS misconfigurations could expose data to unauthorized origins, increasing the risk of data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Update Grav API plugin to version 1.0.10 or later immediately. Review user privileges to ensure only trusted users have api.config.write access. Monitor API configuration changes for unauthorized modifications.

Useful 0 Not Useful 0