IT Security 2 months ago

Grav Stored CSS Injection via Markdown resize() Bypass

Grav 2.0 and 2.0.0‑rc.9 allow stored CSS injection via the Markdown image resize() action, enabling UI redress for privileged sessions. Sanitize resize parameters to mitigate. Grav 2.0 and 2.0.0‑rc.9 allow stored CSS injection via the Markdown image resize() action, enabling UI redress for privileged sessions. Sanitize resize parameters to mitigate.

FacebookXReddit

IT Security

Executive summary

Grav versions in the 2.0 development line (including 2.0.0‑rc.9) contain a stored CSS injection flaw. The vulnerability is triggered through the Markdown image resize() media action, which writes unchecked values into the element’s style attribute. An attacker with lower‑privileged publishing rights can embed malicious CSS that is rendered when a higher‑privileged reviewer or admin views the page, leading to UI redress without JavaScript.

What is affected

  • Grav 2.0 branch – commit 6582166173bb8eb5869d96aea384e0e73777c94c
  • Grav 2.0.0‑rc.9 – commit e03d29aa0d3ece16d73c1ffccfa78df8bf5f28b8

No CVE identifier or CVSS score was provided in the source.

Severity and evidence

  • Severity: Not officially scored; the advisory does not provide a CVSS rating.
  • Evidence: A minimal Markdown payload (![logo](image.png?resize=100;position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999,200)) injects a full‑viewport overlay. The PoC reproducer shows the resulting style attribute containing injected declarations, confirming the bypass of existing sanitizers.

Business or operational impact

The flaw enables stored CSS injection, allowing an attacker to:

  • Overlay or hide page content for administrators.
  • Perform UI redress attacks, potentially tricking admins into unintended actions.
  • Manipulate the visual presentation of the site without needing JavaScript execution.

These risks affect the confidentiality and integrity of administrative sessions.

Detection considerations

  • Scan rendered HTML for unexpected CSS declarations in style attributes of or other media elements.
  • Monitor Markdown edits for query strings containing ?resize= followed by semicolons or additional CSS properties.
  • Log calls to processMediaActions() and flag non‑numeric parameters passed to resize().

Recommended defensive actions

  1. Input validation – Ensure resize() width and height parameters are strictly numeric before appending px.
  2. Sanitization – Apply the same sanitization used for direct style() inputs to any values that populate styleAttributes.
  3. Shared CSS builder – Refactor the code to use a central CSS declaration builder that rejects semicolons, colons, or property names in values.
  4. Regression tests – Add tests covering payloads like resize=100;position:fixed;... to verify the sanitizer blocks them.
  5. Least‑privilege editing – Restrict Markdown publishing rights to trusted users where possible.

Workarounds or mitigations, if supported

  • Disable the resize media action in configuration if it is not required.
  • Filter Markdown content server‑side to strip or reject ?resize= parameters containing characters other than digits and commas.
  • Apply a web‑application firewall rule that detects the pattern resize=.;. in image URLs and blocks the request.

Patch or remediation status

The advisory does not mention an official patch or release that resolves the issue. The recommended remediation is a code change to sanitize/validate resize() parameters as described above. Until a fix is released, administrators should apply the mitigations listed.

References

  • GitHub Security Advisory: https://github.com/advisories/GHSA-ffmg-hfvg-jhg9

Publication date and last checked date

  • Publication date: 2026‑09‑16
  • Last checked: 2026‑09‑17

← Back to IT Security