Stored XSS in Grav Form Plugin via Twig Raw Filter

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the Grav Form plugin versions before 9.1.15. Attackers with form authoring permissions can inject HTML and script payloads into radio and toggle field option labels. These labels are rendered using the Twig |raw filter, which does not escape the input, allowing the payloads to execute in the browsers of visitors and administrators viewing the form.

Useful 0 Not Useful 0

Detection Guidance

Check Grav Form plugin versions with commands like 'composer show | grep grav/form' or 'bin/grav plugin list'. Inspect forms for radio/toggle fields with suspicious option labels containing HTML/script tags. Review server logs for unusual form submissions or payload patterns.

Useful 0 Not Useful 0

Impact Analysis

If you are a user viewing a form with this vulnerability, malicious scripts injected by attackers could steal your session cookies, redirect you to phishing sites, or perform actions on your behalf. Administrators viewing the form may have their accounts compromised, leading to further unauthorized access or data breaches.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face fines or penalties for failing to protect user data adequately.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav Form plugin to version 9.1.15 or later immediately. Remove edit permissions for untrusted users to create forms. Audit existing forms for malicious option labels and remove any suspicious content. Monitor for unusual activity in form submissions.

Useful 0 Not Useful 0