Listen to this Post
The vulnerability operates through the Grav CMS administrative interface where page management is handled. When a POST request is sent to the ‘/admin/pages/[bash]’ endpoint to create or modify a page, the ‘data[bash][template]’ parameter accepts user input without proper sanitization. This parameter corresponds to the template field in the Advanced section of the page editor. Injected JavaScript code, such as <script>alert('PoC-XXS73')</script>, is directly stored within the YAML frontmatter of the page’s markdown file. Upon rendering, whether in the admin panel or frontend, the application parses this frontmatter and outputs the template value in HTML contexts without adequate encoding. The malicious script is thus executed automatically in the browser of any user accessing the affected page, particularly when interacting with elements like the three-dot menu in the Pages list. This stored XSS attack leverages persistent data trusted by the application, allowing attackers to compromise authenticated sessions, steal credentials, or perform unauthorized actions within the admin interface.
Platform: Grav CMS
Version: Unspecified versions
Vulnerability: Stored XSS
Severity: Critical
Date: Not disclosed
Prediction: No patch estimate
What Undercode Say:
Analytics
curl -X POST http://localhost/admin/pages/test -H “Content-Type: application/json” -d ‘{“data”:{“header”:{“template”:”“}}}’ –cookie “grav-admin-session=abc123”
Payload from
Check page file: cat user/pages/01.test/default.md
How Exploit:
1. Login to admin panel.
2. Edit page template field.
3. Inject malicious script.
4. Save and trigger execution.
Protection from this CVE
Implement input validation.
Enforce output encoding.
Use Content Security Policy.
Impact:
Session hijacking
Credential theft
Data exposure
Privilege escalation
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
