Grav Form Plugin HTML Injection via Unescaped Template Properties

Executive Summary

This is a stored Cross-Site Scripting (XSS) vulnerability in the Grav Form Plugin before version 9.1.19. It occurs because the plugin fails to escape certain field-definition properties like prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors due to unescaped |raw filters and unquoted attributes.

Useful 0 Not Useful 0

Detection Guidance

Check Grav Form Plugin version with: grep -r 'grav-plugin-form' /path/to/grav/installation. If version is 9.1.18 or earlier, the system is vulnerable. Inspect form templates for unescaped |raw filters or unquoted attributes in field properties like prepend, append, spacer text, section text, or select option labels.

Useful 0 Not Useful 0

Impact Analysis

If you use the vulnerable Grav Form Plugin version, attackers could inject malicious scripts into forms you create. These scripts would execute for all visitors to your forms, potentially stealing session cookies, redirecting users to malicious sites, or performing actions on behalf of users without their consent.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal user data or session tokens, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised through this exploit.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav Form Plugin to version 9.1.19 or later immediately. If upgrading is not possible, disable the plugin or restrict form authoring privileges to trusted users only. Review all form templates to ensure proper escaping of field properties and select option labels.

Useful 0 Not Useful 0