Grav Arbitrary File Write via Blueprint Validation

Executive Summary

Grav before 2.0.15 has an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation. It uses an incomplete denylist instead of a positive allowlist. Attackers with page-edit or blueprint-config access can exploit this by invoking the error_log function through a data directive to append PHP payloads to web-accessible files, achieving remote code execution.

Useful 0 Not Useful 0

Detection Guidance

Check Grav CMS versions for those below 2.0.15. Inspect web-accessible files for unexpected PHP payloads or recent modifications. Review blueprint configurations for malicious data directives using error_log.

Useful 0 Not Useful 0

Impact Analysis

An attacker with page-edit privileges can write malicious PHP code to web-accessible files. When these files are accessed, the PHP payload executes, allowing the attacker to run arbitrary commands on the server. This can lead to full system compromise, data theft, or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized data access, modification, or exfiltration, violating GDPR's integrity and confidentiality principles and HIPAA's security requirements. Organizations may face fines, legal liabilities, and reputational damage due to non-compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav CMS to version 2.0.15 or later immediately. Replace the denylist in Blueprint validation with a positive allowlist for bare functions. Restrict page-edit and blueprint-config access to trusted users only.

Useful 0 Not Useful 0