CVE-2025-66300

Executive Summary

CVE-2025-66300 is a critical path traversal vulnerability in Grav, a file-based web platform. The flaw allows a low-privileged user with page editing rights to read arbitrary server files via the "Frontmatter" form. This includes sensitive files such as Grav user account YAML files (/grav/user/accounts/*.yaml), which store hashed passwords, 2FA secrets, and password reset tokens. An attacker can leverage this to compromise any registered account by either resetting a password (using the token from the file) or cracking the hashed password. The vulnerability is fixed in version 1.8.0-beta.27. The CVSS score is 8.5 (High), and no public exploit code or PoC is currently available.

Supply Chain & Package Security

Grav is a PHP-based CMS distributed via GitHub and its official website. The vulnerability exists in the core application, not in a third-party package. However, administrators should verify the integrity of their Grav installation and ensure no malicious modifications have been made. The patch is available in the beta release, and users should upgrade immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 8.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires a user account with page editing privileges
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – can read sensitive files
• Integrity Impact: High (I:H) – can compromise user accounts
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is easy to exploit with low privileges and can lead to full account compromise.

Deep Dive & Mechanics

The vulnerability resides in Grav's "Frontmatter" form, which is used to edit page metadata (YAML frontmatter). The form does not properly sanitize file paths provided by the user. A low-privileged user with page editing rights can craft a malicious request to read arbitrary files on the server.

Root Cause: The application fails to validate or restrict the file path input in the frontmatter form, allowing path traversal sequences (e.g., ../) to escape the intended directory.

Attack Flow:

1. Attacker logs in with a low-privileged account that has page editing rights.
2. Attacker navigates to the page editor and modifies the frontmatter field.
3. Attacker injects a path traversal payload (e.g., ../../../grav/user/accounts/admin.yaml) into the file path parameter.
4. The server reads and returns the contents of the specified file.
5. Attacker extracts hashed passwords, 2FA secrets, or password reset tokens.
6. Attacker uses the token to reset a password or cracks the hash to gain full access.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.8.0-beta.27): The vulnerable code likely resides in the frontmatter handling logic. A simplified example:

// Vulnerable: No path validation
$file = $_POST['frontmatter_file'];
$content = file_get_contents($file);
echo $content;

Patched Code (1.8.0-beta.27): The patch adds path validation and restricts file access to allowed directories.

// Patched: Validate path
$allowedDir = GRAV_ROOT . '/user/pages/';
$file = realpath($_POST['frontmatter_file']);
if (strpos($file, $allowedDir) !== 0) {
    die('Access denied');
}
$content = file_get_contents($file);
echo $content;

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A Grav instance running version < 1.8.0-beta.27
• A low-privileged user account with page editing rights

Exploitation Steps:

1. Log in to Grav as the low-privileged user.
2. Navigate to a page you can edit.
3. Open the developer tools or intercept the request with Burp Suite.
4. Modify the frontmatter file parameter to include a path traversal payload:

   POST /admin/pages/edit HTTP/1.1
   ...
   frontmatter_file=../../../grav/user/accounts/admin.yaml
   

5. Send the request and observe the response containing the file contents.

Example cURL command:

curl -X POST -d "frontmatter_file=../../../grav/user/accounts/admin.yaml" -b "session=..." http://target/admin/pages/edit

Blue Team (Defensive)

Detection:

• Monitor for unusual file read requests in web server logs (e.g., frontmatter_file parameter containing ../).
• Alert on access to sensitive files like *.yaml in the user accounts directory.
• Use file integrity monitoring to detect unauthorized reads.

Hunting:

• Search for requests to /admin/pages/edit with frontmatter_file parameter containing path traversal sequences.
• Review logs for successful reads of files outside the expected user/pages/ directory.

Indicators of Compromise (IOCs)

• File Paths: /grav/user/accounts/*.yaml (sensitive files)
• HTTP Requests: POST requests to /admin/pages/edit with frontmatter_file parameter containing ../ or absolute paths.
• Log Entries: Web server logs showing frontmatter_file parameter with path traversal patterns.
• User Activity: Unusual page edits by low-privileged users, especially those targeting non-existent pages.

Detection Engineering

YARA Rule

rule CVE_2025_66300_Grav_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Grav frontmatter form"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66300"
    strings:
        $s1 = "frontmatter_file" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
        $s4 = "/grav/user/accounts/" nocase
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: Grav Frontmatter Path Traversal
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Grav CMS via frontmatter form
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66300
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'frontmatter_file'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in frontmatter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-66300 Grav Frontmatter Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/admin/pages/edit"; http_uri; content:"frontmatter_file"; http_client_body; content:"../"; distance:0; reference:cve,2025-66300; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Grav to version 1.8.0-beta.27 or later.
2. If upgrade is not possible, restrict access to the admin panel to trusted IPs only.
3. Disable page editing for low-privileged users until patched.

Long-term Measures:

• Implement strict input validation for all file paths.
• Use a whitelist of allowed directories for file operations.
• Regularly audit user permissions and remove unnecessary privileges.
• Enable logging and monitoring for suspicious file access patterns.

Workaround:

• Apply a virtual patch using a WAF (Web Application Firewall) to block requests containing frontmatter_file with path traversal sequences.

Valters IT
Securing Digital Frontiers