Grav CMS Plugin RCE via Malicious ZIP Upload

Executive Summary

Grav CMS before version 2.0.13 has a remote code execution vulnerability in the Flex Objects plugin. Authenticated users can upload a malicious ZIP file containing PHP code and bypass name validation using array notation instead of string notation. This allows calling the unZip routine to write PHP files to the web root, which can then be executed to run arbitrary commands on the server.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS version with command: grep -r "version" /path/to/grav/vendor/getgrav/grav/version.yaml. If version is below 2.0.13, the system is vulnerable. Inspect uploaded ZIP files for PHP code and monitor web root directories for unexpected PHP files.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to a vulnerable Grav CMS instance can upload a malicious ZIP file and execute arbitrary PHP code on the server. This could lead to full server compromise, data theft, or further network infiltration. The attack requires only a session cookie and API token, which can be obtained through normal login procedures.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. A successful exploit may result in data breaches, unauthorized data processing, or loss of control over personal health information, leading to regulatory penalties and legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 2.0.13 or later immediately. Remove write permissions from web root directories. Disable the Flex Objects plugin if not needed. Monitor for unauthorized PHP files in the web root and restrict access to the Media tab for untrusted users.

Useful 0 Not Useful 0