Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
High
Difficult to exploit
Attack Requirements
Present
Additional conditions required
Privileges Required
None
No privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 3
https://github.com/getgrav/grav/commit/f9438d4e71389b1041ac60b69b0b5714ecfa3bdd
disclosure@vulncheck.com
https://github.com/getgrav/grav/security/advisories/GHSA-4pqv-2qj5-38fp
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/grav-api-plugin-before-broken-access-contr…
disclosure@vulncheck.com