Stored XSS in Grav CMS via Unquoted Attribute Event Handlers

Executive Summary

Grav before version 2.0.15 has a stored cross-site scripting (XSS) vulnerability in the detectXss() function. Unpaired quotes in unquoted HTML attribute values can bypass event-handler detection, allowing authenticated editors to inject malicious event handlers like onerror=. These payloads evade validation and execute in visitor browsers when page content is rendered.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Grav CMS installations for versions before 2.0.15. Check the Grav version in your system files or admin panel. Look for suspicious event handlers like onerror= in content edited by non-super admin users. Use commands like grep -r "detectXss" /path/to/grav or check Grav's version via bin/grav version if available.

Useful 0 Not Useful 0

Impact Analysis

Attackers with editor access can inject malicious scripts into Grav pages. When visitors view these pages, the scripts execute in their browsers, potentially stealing session cookies, redirecting users, or performing actions on their behalf. This affects all visitors to compromised pages.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may expose protected health information if exploited. Both standards require safeguards against unauthorized data access, which this flaw undermines.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Grav CMS to version 2.0.15 or later. If updating is not possible, review and sanitize all content edited by non-super admin users for malicious event handlers. Disable editing privileges for non-trusted users until patched. Monitor for unusual activity or unauthorized content changes.

Useful 0 Not Useful 0