Listen to this Post
The CVE-2021-21425 vulnerability in Grav CMS stems from improper authorization checks in the Admin plugin’s page editing endpoint. When an editor user with ‘pages’ permissions sends a POST request to /admin/pages/{page_name}, the server fails to validate if the user is allowed to modify the form’s process logic. The form configuration is stored as YAML frontmatter within the page data, accessible via the `data[bash][header][bash]` parameter. Although the admin interface hides these fields from editors, the backend API does not enforce role-based restrictions on this parameter. An attacker can intercept a legitimate page save request and inject a malicious `process` array into the YAML payload. For example, a process value containing `{{ evaluate_twig(form.value(‘name’)) }}` leads to server-side template injection (SSTI). This Twig code is executed when the modified form is submitted, bypassing the sandbox and allowing arbitrary PHP code execution. The core issue is the lack of server-side validation contrasting the UI’s client-side restrictions, enabling privilege escalation through a simple parameter manipulation.
Platform: Grav CMS
Version: < 1.10.13
Vulnerability: Broken Access Control
Severity: Critical
Date: 2021-04-19
Prediction: Patch 2021-04-19
What Undercode Say:
Analytics:
curl -X POST \
-H “Cookie: grav-site-xxxx=…” \
-H “Content-Type: application/x-www-form-urlencoded” \
-d “admin-nonce=xxx&data%5B_json%5D%5Bheader%5D%5Bform%5D=%7B%22name%22%3A%22test%22%2C%22process%22%3A%5B%7B%22message%22%3A%22%7B%7B+evaluate_twig(‘phpinfo()’)+%7D%7D%22%7D%5D%7D” \
http://localhost/admin/pages/test-page
How Exploit:
Intercept save request.
Modify form YAML.
Inject Twig payload.
Execute on submission.
Protection from this CVE:
Update Grav CMS.
Apply authorization checks.
Validate form fields.
Impact:
Remote Code Execution.
Form Logic Manipulation.
Privilege Escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
