PT-2021-14497 · Grav · Grav Admin Plugin

Mehmet Ince · Published 2021-04-07 · Updated 2022-10-24 · CVE-2021-21425

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Grav Admin Plugin versions 1.10.7 and earlier

Description The issue allows an unauthenticated user to execute certain methods of the administrator controller without credentials, resulting in arbitrary YAML file creation or modification. This can lead to configuration changes, such as altering site information or scheduler jobs. An adversary can exploit this to change parts of the webpage, hijack an administrator account, or execute operating system commands under the web-server user context.

Recommendations For versions 1.10.7 and earlier, update to version 1.10.8 to resolve the issue. As a temporary workaround, consider blocking access to the "/admin" path from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-21425

GHSA-6F53-6QGV-39PJ

Affected Products

Grav Admin Plugin

References · 11

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/gravcms_exec.rb · Exploit
• 🔥 https://github.com/CsEnox/CVE-2021-21425 · Exploit
• 🔥 https://pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution · Exploit
• 🔥 https://exploit-db.com/exploits/49788 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21425 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21425 · Security Note
• https://github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj · Note
• https://t.me/rnetsec/14745 · Telegram Post
• http://packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.html · Note
• https://t.me/defcon_news/73330 · Telegram Post
• http://packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html · Note