The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products 2
| Configuration | From (including) | Up to (excluding) |
|---|---|---|
|
Getgrav Grav
cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
|
2.0.11
|
<= 2.0.11
|
|
Getgrav Grav
cpe:2.3:a:getgrav:grav:*:*:*:*:*:*:*:*
|
— |
1.4.7
|
References 6
https://github.com/getgrav/grav/commit/0b384f5b0e73b1ad9dd29c70185407895ea3b09f
disclosure@vulncheck.com
https://github.com/getgrav/grav/commit/8071c10bc3a4743a4b8cf003dfb1644d6680c2ea
disclosure@vulncheck.com
https://github.com/getgrav/grav/commit/a0bf26f7e5d7a98894b7cd2b8c5afe419b264e53
disclosure@vulncheck.com
https://github.com/getgrav/grav/commit/ad9709f865b09b68798fb1ac375b484a8cc1d892
disclosure@vulncheck.com
https://github.com/getgrav/grav/security/advisories/GHSA-pc8m-jxvh-vmrc
disclosure@vulncheck.com
https://www.vulncheck.com/advisories/grav-through-authentication-bypass-via-fle…
disclosure@vulncheck.com