Listen to this Post
The vulnerability exists in the user account management endpoint /admin/accounts/users/{username}. When a low-privilege authenticated user requests another user’s profile page (e.g., the admin account), the application correctly returns a 403 Forbidden HTTP status code, denying full page rendering. However, the backend authorization check occurs after sensitive data, like the target user’s email, has already been retrieved and embedded into the page template. This data is present within the HTML source code, specifically within the `<>` tag which formats as “Grav Admin | {username} <{email}>”, even though the user is not authorized to view the page. The flaw originates in the user collection logic (UserCollection.php) which fetches user objects, and the associated blueprint (user-accounts.yaml) that defines the data structure, without a sufficient server-side validation layer to strip or block unauthorized data before it is sent in the response.
Platform: Grav CMS
Version: 1.7.48
Vulnerability: IDOR
Severity: Medium
Date: 2022-03-28
Prediction: Patch 2022-04-11
What Undercode Say:
curl -s -H "Cookie: grav-site-xxxx=..." "http://target/admin/accounts/users/admin" | grep -oP '<>.<\/>'
// Example vulnerable pattern in UserCollection.php $user = $this->get($username); // Missing early authorization check here $email = $user->email; // Data passed to template
How Exploit:
1. Attacker obtains low-privilege account.
2. Attacker browses to admin profile endpoint.
3. Attacker views page source.
4. Attacker extracts admin email.
Protection from this CVE:
Implement proper authorization.
Validate access before data retrieval.
Sanitize error page responses.
Impact:
Information disclosure.
Phishing campaign enabler.
Credential stuffing risk.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
