IT Security 1 month ago

Grav CMS Remote Code Execution via ZIP File Upload

Grav CMS allows a logged‑in user to upload a malicious ZIP archive that can be unpacked into the public directory, leading to remote code execution. Grav CMS allows a logged‑in user to upload a malicious ZIP archive that can be unpacked into the public directory, leading to remote code execution.

FacebookXReddit

IT Security

Executive summary

A vulnerability in Grav CMS lets a logged‑in attacker upload a ZIP archive that is automatically unpacked into the web root, creating a PHP web shell and granting remote code execution as the web‑server user.

What is affected

  • Grav CMS core (any version that includes the vulnerable routine).
  • The Flex Objects plugin, which stores configuration that can point to the unsafe routine.
  • The Grav\\Common\\GPM\\Installer::unZip routine used for plugin installation.

Severity and evidence

  • No CVSS score or CVE identifier was provided in the advisory; severity is not formally confirmed.
  • The advisory includes a detailed proof‑of‑concept showing how a ZIP file uploaded via the Media tab can be unpacked into the document root and executed.

Business or operational impact

Successful exploitation gives the attacker full command execution on the server, compromising all data, services, and potentially the underlying host. The impact is equivalent to a full system takeover.

Detection considerations

  • Unexpected ZIP files appearing in /user/media/.
  • New PHP files (e.g., shell.php) created in the web‑document root.
  • API calls to /api/v1/config/plugins/flex-objects that modify the directories or form fields.
  • Logs showing the Grav\\Common\\GPM\\Installer::unZip routine being invoked with user‑supplied arguments.

Recommended defensive actions

  1. Restrict upload of ZIP files or disable media uploads for untrusted users.
  2. Apply strict validation on routine names; ensure component‑routine pairs are also checked against the safe list.
  3. Disable or remove the Flex Objects plugin if it is not required.
  4. Enforce least‑privilege file permissions; prevent the web server from executing files in the media directory.
  5. Monitor API activity for suspicious PATCH/POST requests to the Flex Objects configuration endpoints.

Workarounds or mitigations, if supported

  • Move the media directory outside the publicly served document root and configure the web server to deny execution of files from that location.
  • Use a web‑application firewall (WAF) to block requests that attempt to set data-default@ with the unZip routine.
  • Implement server‑side checks that reject ZIP uploads containing PHP files.

Patch or remediation status

The advisory does not mention an available patch, CVE number, or vendor‑issued fix. The status of remediation is therefore not confirmed.

References

  • GitHub Security Advisory: https://github.com/advisories/GHSA-r94f-hx44-8jqf

← Back to IT Security