Symlink Following in Grav CMS Prior to 2.0.16

Executive Summary

Grav CMS before version 2.0.16 has a symlink following vulnerability in the Scheduler Job::createLockFile() function. This flaw allows local attackers to overwrite arbitrary files by creating symlinks at predictable lock file paths in the world-writable temp directory. The attacker places a symlink pointing to a target file, and when the scheduled job runs, it follows the symlink and overwrites the target file with the job ID string.

Useful 0 Not Useful 0

Detection Guidance

Check for symlinks in the temporary directory pointing to sensitive files. Look for files matching the predictable lock file pattern in /tmp or the system temp directory. Use commands like 'ls -la /tmp | grep -E "grav|lock"' to inspect for suspicious symlinks. Monitor for unexpected file modifications in system directories.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to file corruption, denial of service, or unauthorized file modifications. Attackers could overwrite critical system files, configuration files, or application data, potentially disrupting services or enabling further attacks. The impact depends on the files writable by the web server process.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized file overwrites. For GDPR, it may lead to unauthorized access or modification of personal data if sensitive files are targeted. For HIPAA, it could result in unauthorized changes to protected health information if the web server process has write access to such files. Both standards require protection against unauthorized data access or modification, which this vulnerability could facilitate.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 2.0.16 or later immediately. Restrict write permissions to the temporary directory to prevent symlink creation. Move the lock file directory outside the world-writable temp directory. Verify no symlinks exist in the temp directory pointing to critical files.

Useful 0 Not Useful 0