Grav .htaccess Case-Insensitive Extension Bypass

Grav CMS (v2.0.1 and earlier) utilizes an .htaccess file to restrict access to sensitive file types stored within the user/ and system/vendor/ directories. These directives are intended to return a 403 Forbidden status for requests targeting files with extensions such as .yaml, .json, and .php. However, the current configuration rules lack the [NC] (No Case) Apache directive flag.

On case-insensitive filesystems, such as NTFS (Windows) or HFS+ (macOS), the operating system resolves uppercase extensions to the same file path as their lowercase counterparts, but the web server fails to match the blocking rule. Consequently, an attacker can access sensitive data by requesting files with uppercase extensions (e.g., .YAML instead of .yaml). This can lead to the exposure of API keys, administrative credentials, and application source code, depending on the server configuration. The vulnerability is mitigated on native Linux distributions utilizing case-sensitive filesystems like ext4.

Impact

The vulnerability results in unauthorized information disclosure of critical configuration and source files. Attackers can exfiltrate sensitive plugin data (including API keys), system configuration files (system.yaml), and potentially source code if the server is configured to serve .PHP files as static content rather than executing them. This impacts any Grav instance deployed on Windows, macOS, or Docker environments with volumes mounted from these systems.

Recommendation

• Immediately update to Grav version 2.0.4 or later where the missing [NC] flags have been applied to the rewrite rules.
• If immediate patching is not possible, manually edit the root .htaccess file to append the [NC] flag to the relevant RewriteRule definitions on lines 68, 70, and 72.
• Review Apache web server logs for HTTP 200 responses to requests targeting sensitive file types with non-standard capitalization, specifically focusing on user/ and system/vendor/ URI paths.
• Audit infrastructure deployments to ensure that web-facing sensitive directories are not hosted on case-insensitive volumes.