Attack Chain

1. The attacker gains access to the Grav server’s filesystem with write privileges to the cache directory.
2. The attacker crafts a malicious PHP object that, when unserialized, will execute arbitrary code. This payload could leverage existing classes or magic methods like __wakeup() to achieve code execution.
3. The attacker serializes the malicious PHP object using the serialize() function.
4. The attacker overwrites an existing cache file or creates a new one containing the serialized payload in the Grav cache directory (location varies based on configuration, but default is often in cache/).
5. The Grav application attempts to read the tampered cache file using the FileCache::doGet() function.
6. The unserialize($value, ['allowed_classes' => true]) function is called on the tampered cache data.
7. The malicious PHP object is deserialized, triggering the execution of the attacker’s code.
8. The attacker achieves arbitrary code execution on the Grav server, potentially leading to full system compromise, data exfiltration, or further malicious activities.

Impact

Successful exploitation of this vulnerability allows attackers to execute arbitrary code on the Grav server. This can lead to complete system compromise, data exfiltration, defacement of websites, or the installation of backdoors for persistent access. Given that Grav is a CMS, this can impact any website or application built on the platform. The number of potential victims is dependent on the number of Grav installations running the vulnerable versions (1.7.44 - 1.7.49.5) and the attacker’s ability to access and modify the cache files.

Recommendation

• Upgrade to Grav version 2.0.0-beta.2 or later, where the vulnerability is addressed with HMAC signing of cache payloads, as detailed in commit c66dfeb5f.
• Monitor file system access, particularly writes to the cache directory, for suspicious activity. Consider deploying file integrity monitoring tools to detect unauthorized modifications to cache files.
• If upgrading is not immediately feasible, implement strict access controls to the cache directory to prevent unauthorized write access.
• Review and audit any plugins or custom code that utilize the Grav\Framework\Cache\Adapter\FileCache class, ensuring they are not susceptible to cache poisoning attacks.
• Implement the provided PoC locally to validate your exposure and test the effectiveness of mitigations.