Remote Code Execution in Grav API Plugin via Privilege Escalation

Grav API plugin versions before 1.0.13 are susceptible to a privilege management vulnerability (CWE-269) located in the ConfigController component. The plugin fails to adequately enforce scope restrictions for API keys, specifically regarding the 'api.config.write' permission. An attacker possessing a restricted API key with this scope can bypass intended access controls to modify the site's scheduler configuration. By manipulating the 'scheduler.custom_jobs' parameter, an attacker can inject arbitrary shell commands. These commands are subsequently executed by the underlying Symfony Process component, resulting in remote code execution (RCE) on the host server. This vulnerability is highly critical due to the potential for unauthenticated or low-privilege access to lead to full system compromise. Users of the Grav API plugin must upgrade to version 1.0.13 or later immediately to remediate this flaw.

Attack Chain

1. Attacker obtains or identifies an API key possessing the 'api.config.write' scope.
2. Attacker crafts a malicious HTTP POST request targeting the ConfigController endpoint.
3. The request includes a modified payload for the 'scheduler.custom_jobs' configuration setting.
4. The Grav API plugin fails to validate the key scope against the requested action.
5. The malicious configuration is saved to the backend storage by the vulnerable ConfigController.
6. The application invokes the scheduler service which reads the injected 'custom_jobs' entry.
7. The system executes the injected commands via the Symfony Process component.
8. Attacker achieves remote code execution in the context of the web server process.

Impact

Successful exploitation allows for full remote code execution on the server hosting the Grav instance. This can lead to unauthorized data access, system-wide configuration changes, or complete compromise of the web server, potentially impacting all data processed by the affected Grav deployment.

Recommendation

Prioritized actions for detection and remediation:

• Update the Grav API plugin to version 1.0.13 or later across all environments immediately.
• Audit all active API keys, specifically those with 'api.config.write' scope, and revoke any that appear suspicious or are no longer required.
• Deploy the provided Sigma rule to monitor for suspicious API configuration changes that include command execution patterns.
• Enable web server access logs and monitor for POST requests targeting the Grav API 'ConfigController' endpoint originating from unusual or untrusted sources.