{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata — refreshed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/grav/","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Grav CMS","composer/getgrav/grav (\u003c 2.0.0-beta.2)"],"_cs_severities":["critical"],"_cs_tags":["rce","unserialize","command-injection","ssti"],"_cs_type":"threat","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eMultiple remote code execution (RCE) vulnerabilities have been identified in Grav CMS, a flat-file content management system. These vulnerabilities, including unsafe unserialize functions in JobQueue, FileCache, and Session, a command injection in git clone, and a server-side template injection (SSTI) blocklist bypass, allow attackers to execute arbitrary code on affected systems. The vulnerabilities are present in Grav CMS versions prior to 2.0.0-beta.2 and were patched in commit c66dfeb5f and 38685ac25. Successful exploitation of these vulnerabilities could lead to complete system compromise, data theft, and disruption of service. The most concerning are the unserialize issues, as they do not require admin access and can be triggered by any file write primitive.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains the ability to write files to the Grav CMS server, either through an existing vulnerability (e.g., file upload) or misconfiguration.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a serialized PHP object containing malicious code.\u003c/li\u003e\n\u003cli\u003eFor JobQueue or FileCache exploitation, the attacker writes this serialized object to the appropriate cache file location. For Session exploitation, the attacker sets a crafted serialized object within a session variable.\u003c/li\u003e\n\u003cli\u003eThe Grav CMS application deserializes the crafted object using \u003ccode\u003eunserialize()\u003c/code\u003e, without proper input validation.\u003c/li\u003e\n\u003cli\u003eThe deserialization process instantiates the malicious object, triggering the execution of arbitrary code. Specifically, the JobQueue vulnerability allows direct RCE via \u003ccode\u003eJob::exec → call_user_func_array\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFor the git clone command injection, an administrator attempts to install a malicious plugin or theme. The attacker injects commands into the \u003ccode\u003ebranch\u003c/code\u003e, \u003ccode\u003eurl\u003c/code\u003e, or \u003ccode\u003epath\u003c/code\u003e parameters within the plugin\u0026rsquo;s or theme\u0026rsquo;s configuration.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eInstallCommand.php\u003c/code\u003e script executes a \u003ccode\u003egit clone\u003c/code\u003e command, incorporating the attacker-controlled parameters without proper sanitization.\u003c/li\u003e\n\u003cli\u003eThe injected commands are executed on the server, granting the attacker arbitrary code execution.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of these vulnerabilities can lead to complete system compromise. An attacker could gain unauthorized access to sensitive data, modify website content, install backdoors, or use the compromised server as a launchpad for further attacks. The unserialize vulnerabilities are especially critical as they do not require administrative privileges if an attacker can write to the cache directory. The impact includes potential data theft, service disruption, and reputational damage.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Grav CMS to version 2.0.0-beta.2 or later to patch the vulnerabilities described in this brief.\u003c/li\u003e\n\u003cli\u003eImplement the Sigma rule \u003ccode\u003eDetect Unsafe PHP Unserialize\u003c/code\u003e to identify attempts to exploit the unserialize vulnerabilities in web server logs.\u003c/li\u003e\n\u003cli\u003eReview and harden file upload and file management functionalities to prevent unauthorized file writes to the Grav CMS server.\u003c/li\u003e\n\u003cli\u003eMonitor process creation events for git commands executed by the web server user, using the Sigma rule \u003ccode\u003eDetect Git Clone Command Injection\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-09T12:00:00Z","date_published":"2024-01-09T12:00:00Z","id":"/briefs/2024-01-grav-rce/","summary":"Multiple critical and high severity remote code execution vulnerabilities exist in Grav CMS due to unsafe unserialize functions, command injection in git clone, and an SSTI blocklist bypass, impacting versions prior to 2.0.0-beta.2.","title":"Grav CMS Multiple RCE Vulnerabilities","url":"https://feed.craftedsignal.io/briefs/2024-01-grav-rce/"},{"_cs_actors":[],"_cs_cves":[],"_cs_exploited":false,"_cs_products":["Login Plugin","Grav Core","grav-plugin-login"],"_cs_severities":["critical"],"_cs_tags":["grav","privilege-escalation","web"],"_cs_type":"advisory","_cs_vendors":["Grav"],"content_html":"\u003cp\u003eA critical privilege escalation vulnerability exists in the Grav CMS Login plugin, version 3.8.0, affecting Grav Core versions prior to 2.0.0-beta.2. The vulnerability stems from the \u003ccode\u003eLogin::register()\u003c/code\u003e method not validating the \u003ccode\u003egroups\u003c/code\u003e and \u003ccode\u003eaccess\u003c/code\u003e fields during user registration. If registration is enabled and these fields are included in the allowed registration fields, an unauthenticated user can craft a malicious registration request to assign themselves admin privileges. This can lead to complete compromise of the Grav CMS instance, allowing attackers to modify content, install malicious plugins, and potentially execute arbitrary code. The vulnerability is tracked as CVE-2026-42613. The fix was applied on 2026-04-24 and released in grav-plugin-login 3.8.2.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a Grav CMS instance with user registration enabled and the \u003ccode\u003egroups\u003c/code\u003e or \u003ccode\u003eaccess\u003c/code\u003e fields included in the allowed registration fields.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious HTTP POST request to the \u003ccode\u003e/user_register\u003c/code\u003e endpoint, including \u003ccode\u003eusername\u003c/code\u003e, \u003ccode\u003epassword\u003c/code\u003e, \u003ccode\u003eemail\u003c/code\u003e, and \u003ccode\u003efullname\u003c/code\u003e fields.\u003c/li\u003e\n\u003cli\u003eThe attacker injects \u003ccode\u003egroups\u003c/code\u003e and \u003ccode\u003eaccess\u003c/code\u003e fields into the POST request with values designed to grant admin privileges (e.g., \u003ccode\u003egroups[]=admins\u003c/code\u003e, \u003ccode\u003eaccess[admin][super]=true\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eLogin::register()\u003c/code\u003e method processes the registration data without proper validation of the injected \u003ccode\u003egroups\u003c/code\u003e and \u003ccode\u003eaccess\u003c/code\u003e fields.\u003c/li\u003e\n\u003cli\u003eThe attacker-controlled \u003ccode\u003egroups\u003c/code\u003e and \u003ccode\u003eaccess\u003c/code\u003e values are assigned directly to the newly created user object.\u003c/li\u003e\n\u003cli\u003eThe user object is saved, creating a new user account with admin privileges in the \u003ccode\u003euser/accounts/\u003c/code\u003e directory.\u003c/li\u003e\n\u003cli\u003eThe attacker logs in to the Grav admin panel using the newly created account.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages their admin access to install malicious plugins or execute arbitrary code on the server, achieving complete system compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability grants unauthenticated attackers full administrative access to the Grav CMS instance. This can lead to complete website defacement, data exfiltration, or remote code execution. Since no victim count or specific sector targeting is mentioned in the advisory, we can assume any Grav instance with the vulnerable configuration is at risk, potentially impacting numerous websites and organizations relying on Grav CMS.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to grav-plugin-login version 3.8.2 or later to patch CVE-2026-42613.\u003c/li\u003e\n\u003cli\u003eIf upgrading is not immediately feasible, remove \u003ccode\u003egroups\u003c/code\u003e and \u003ccode\u003eaccess\u003c/code\u003e from the allowed registration fields in the Login plugin configuration.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u003ccode\u003eDetect Malicious Grav User Registration\u003c/code\u003e to identify registration attempts with injected admin privileges based on user-registration requests.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for POST requests to the \u003ccode\u003e/user_register\u003c/code\u003e endpoint containing \u003ccode\u003egroups\u003c/code\u003e or \u003ccode\u003eaccess\u003c/code\u003e parameters using the \u003ccode\u003eGrav Registration Attempt with Group/Access Parameters\u003c/code\u003e Sigma rule.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2024-01-03T12:00:00Z","date_published":"2024-01-03T12:00:00Z","id":"/briefs/2024-01-grav-privesc/","summary":"Unauthenticated users can escalate privileges to admin in Grav CMS by manipulating registration data due to missing server-side validation in the Login plugin.","title":"Grav Login Plugin Privilege Escalation Vulnerability","url":"https://feed.craftedsignal.io/briefs/2024-01-grav-privesc/"}],"language":"en","title":"CraftedSignal Threat Feed — Grav","version":"https://jsonfeed.org/version/1.1"}