Open Redirect Vulnerability in Grav Form Plugin

Executive Summary

The Grav form plugin before version 9.1.13 has an open redirect vulnerability. Since version 9.1.11, the plugin evaluates user-supplied form data in Twig expressions for redirects. If a form blueprint uses a redirect target like {{ form.value('next') }}, an attacker can input a malicious URL such as https://evil.com. This causes the server to issue a 302 redirect to the external site, enabling phishing attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Grav installations using the form plugin version before 9.1.13. Check for form blueprints with redirect actions using Twig expressions like redirect: "{{ form.value('next') }}". Review server logs for unexpected 302 redirects to external domains.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to redirect users to malicious websites, potentially stealing credentials or spreading malware. Users may unknowingly visit harmful sites, leading to account compromise or data theft. Organizations using the vulnerable plugin risk phishing attacks and reputational damage.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR's requirement for protecting personal data and HIPAA's safeguards for protected health information. Organizations may face fines or penalties for failing to prevent unauthorized redirects that expose sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the Grav form plugin to version 9.1.13 or later to address the open redirect vulnerability. Review form blueprints to ensure redirect targets do not use user-supplied form data in Twig expressions. Monitor network traffic for unexpected redirects to external domains.

Useful 0 Not Useful 0