Path Traversal in Grav CMS via Admin Plugin

Executive Summary

This is a path traversal vulnerability in Grav's admin plugin versions before 1.10.55. An authenticated admin user with specific permissions can exploit the Save As action by manipulating the language code parameter to write arbitrary .md files outside the intended pages directory. The vulnerability occurs because the lang POST field is not properly validated, allowing directory traversal sequences like ../ to escape the pages directory.

Useful 0 Not Useful 0

Detection Guidance

Check Grav admin plugin version with: grep -r '"version"' /path/to/grav/admin/plugins/admin/plugin.yaml. If version is below 1.10.55, the system is vulnerable. Monitor for unexpected .md files outside the pages directory or unusual POST requests to /admin/tasks/saveas with lang parameter containing ../ sequences.

Useful 0 Not Useful 0

Impact Analysis

An attacker could write malicious .md files anywhere on the server filesystem where the web server has write permissions. This could lead to remote code execution, defacement of websites, or unauthorized access to sensitive data. The impact depends on server configuration and permissions but could be severe for compromised systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file writes that compromise data integrity or confidentiality, potentially violating GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations may face compliance violations if exploited, resulting in legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Grav admin plugin to version 1.10.55 or later immediately. Remove admin.pages.create permissions from non-trusted admin users. Review and remove any unauthorized .md files outside the pages directory. Monitor admin logs for suspicious saveas actions with unusual lang parameters.

Useful 0 Not Useful 0