ghsa-v8x2-fjv7-8hjh
Vulnerability from github
Published
2025-12-02 00:36
Modified
2025-12-02 00:36
Severity ?
8.6 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Summary
Grav has Broken Access Control which allows an Editor to modify the page's YAML Frontmatter to alter form processing actions
Details

Summary

Due to a broken access control vulnerability in the /admin/pages/{page_name} endpoint, an editor ( user with full permissions to pages ) can change the functionality of a form after submission.

Details

Due to improper authorization checks when modifying critical fields on a POST request to /admin/pages/{page_name}, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the data[_json][header][form] which is the YAML frontmatter which includes the process section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities.

PoC

  • Have Admin and Form plugins installed
  • Connect to panel as admin, create user and give him permission for pages all
  • Now connect as that user and notice you cant edit any process field in the panel
  • Change anything in the content of the form and save

  • Intercept the request: image

  • Now modify the field `data[_json][header][form] with the following payload URL-encoded not like this: {"name":"ssti-test 2","fields":{"name":{"type":"text","label":"Name","required":true}},"buttons":{"submit":{"type":"submit","value":"Submit"}},"process":[{"message":"{{ evaluate_twig(form.value('name')) }}"}]}

  • Change the field and forward it: image

Request goes through and changes have been made to the form. image

Impact

  • Attacker can modify submission logic of the form which leads to changing redirect value, email sending, changing template, breaking out of the Twig sandbox potentially executing code...

Fix recommendation

  • Implement proper authorization checks to such requests especially when it contains fields user shouldn't be able to modify based on his role.
Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getgrav/grav"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.8.0-beta.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-66301"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-12-02T00:36:51Z",
    "nvd_published_at": "2025-12-01T22:15:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nDue to a broken access control vulnerability in the `/admin/pages/{page_name}` endpoint, an editor ( user with full permissions to pages ) can change the functionality of a form after submission.\n\n### Details\nDue to improper authorization checks when modifying critical fields on a POST request to `/admin/pages/{page_name}`, an editor with only permissions to change basic content on the form is now able to change the functioning of the form through modifying the content of the `data[_json][header][form]` which is the YAML frontmatter which includes the `process` section which dictates what happens after a user submits the form which include some important actions that could lead to further vulnerabilities.\n\n### PoC\n\n- Have Admin and Form plugins installed\n- Connect to panel as admin, create user and give him permission for pages all\n- Now connect as that user and notice you cant edit any process field in the panel\n- Change anything in the content of the form and save\n- Intercept the request:\n![image](https://github.com/user-attachments/assets/a66767d9-648e-45b5-9031-4a15bee3072a)\n\n- Now modify the field `data[_json][header][form] with the following payload URL-encoded not like this:\n```\n{\"name\":\"ssti-test 2\",\"fields\":{\"name\":{\"type\":\"text\",\"label\":\"Name\",\"required\":true}},\"buttons\":{\"submit\":{\"type\":\"submit\",\"value\":\"Submit\"}},\"process\":[{\"message\":\"{{ evaluate_twig(form.value(\u0027name\u0027)) }}\"}]}\n```\n\n- Change the field and forward it:\n![image](https://github.com/user-attachments/assets/dd5f95d7-c61f-4fc0-9e9a-e67825f20aea)\n\nRequest goes through and changes have been made to the form.\n![image](https://github.com/user-attachments/assets/42a77e10-571b-43a2-8410-14d82dba28e5)\n\n### Impact\n\n- Attacker can modify submission logic of the form which leads to changing redirect value, email sending, changing template, breaking out of the Twig sandbox potentially executing code...\n\n### Fix recommendation\n\n- Implement proper authorization checks to such requests especially when it contains fields user shouldn\u0027t be able to modify based on his role.",
  "id": "GHSA-v8x2-fjv7-8hjh",
  "modified": "2025-12-02T00:36:51Z",
  "published": "2025-12-02T00:36:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getgrav/grav/security/advisories/GHSA-v8x2-fjv7-8hjh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66301"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getgrav/grav"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Grav has Broken Access Control which allows an Editor to modify the page\u0027s YAML Frontmatter to alter form processing actions"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.