Grav is a file-based Web platform. Prior to 2.0.0-beta.2, a low-privileged (with the ability to create a page) user can cause XSS with the injection of svg element. The XSS can further be escalated to dump the entire system information available under /admin/config/info whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE). This vulnerability is fixed in 2.0.0-beta.2.

Affected: Packagist: getgrav/grav

### Summary A low-privileged (with the ability to create a page) user can cause XSS with the injection of `svg` element. The XSS can further be escalated to dump the entire system information available under `/admin/config/info` whenever a Super Admin visits the page; which can further be chained with the use of admin-nonce to do a complete server compromise (RCE).

### Details Affected endpoint: `admin/pages/<page>` Affected code: `system/src/Grav/Common/Security.php`

```php public static function detectXss($string, array $options = null): ?string { // Skip any null or non string values if (null === $string || !is_string($string) || empty($string)) { return null; }

if (null === $options) { $options = static::getXssDefaults(); }

$enabled_rules = (array)($options['enabled_rules'] ?? null); $dangerous_tags = (array)($options['dangerous_tags'] ?? null); if (!$dangerous_tags) { $enabled_rules['dangerous_tags'] = false; } $invalid_protocols = (array)($options['invalid_protocols'] ?? null); if (!$invalid_protocols) { $enabled_rules['invalid_protocols'] = false; } $enabled_rules = array_filter($enabled_rules, static function ($val) { return !empty($val); }); if (!$enabled_rules) { return null; }

// Keep a copy of the original string before cleaning up $orig = $string;…