Grav CMS Host Header Injection via sendInvitationEmail

Executive Summary

Grav before version 3.9.2 has a vulnerability where the sendInvitationEmail() function does not properly validate untrusted Host headers. Attackers can manipulate this header to poison invitation links, redirecting users to malicious domains. The require_trusted_host protection only covers password reset flows, leaving invitation links vulnerable.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Grav instance is running a version before 3.9.2. Use commands like 'bin/grav version' or check the version in the admin panel. Inspect email templates for the sendInvitationEmail() function to see if it lacks untrusted Host header validation. Monitor logs for missing warnings about untrusted hosts in invitation links.

Useful 0 Not Useful 0

Impact Analysis

Attackers could trick users into clicking malicious links via poisoned invitation emails, leading to phishing attacks or credential theft. Users might unknowingly visit attacker-controlled domains, risking data exposure or account compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or phishing attacks, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information. Non-compliance may result in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Grav to version 3.9.2 or later. If updating is not possible, ensure the require_trusted_host setting is properly configured in the login plugin. Add the missing warnIfUntrustedHost('invitation') call to the sendInvitationEmail() function. Review and restrict Host header manipulation in reverse proxies or web servers.

Useful 0 Not Useful 0