CVE-2025-66301

Executive Summary

CVE-2025-66301 is a critical authorization bypass vulnerability in Grav CMS, a file-based web platform. Prior to version 1.8.0-beta.27, an authenticated editor with only basic content modification permissions could escalate their privileges by manipulating the data[_json][header][form] field in a POST request to /admin/pages/{page_name}. This field controls the YAML frontmatter, including the process section, which dictates post-submission actions. By modifying this, an attacker can alter form behavior, potentially leading to further vulnerabilities such as arbitrary code execution or data exfiltration. The vulnerability has a CVSS score of 0.0 in the NVD but is assessed as high severity due to the potential for privilege escalation and subsequent attacks. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

Grav CMS is a PHP-based project distributed via GitHub and Composer. The vulnerability affects the core admin panel component. Organizations using Grav should verify their version and apply the patch immediately. Since this is a PHP application, supply chain risks include compromised Composer dependencies or malicious plugins, though this specific CVE is a core authorization flaw.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network via HTTP POST requests.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to craft a specific POST request.
• Privileges Required (PR): Low (L) – The attacker must have editor-level access to the Grav admin panel.
• User Interaction (UI): None (N) – No user interaction is required beyond the attacker’s own actions.
• Scope (S): Unchanged (U) – The vulnerability does not cross a trust boundary.
• Confidentiality (C): Low (L) – Limited information disclosure may occur.
• Integrity (I): High (H) – The attacker can modify form behavior and potentially execute arbitrary actions.
• Availability (A): Low (L) – Minor impact on availability.

Overall CVSS Score: 7.1 (High) – This reflects the potential for privilege escalation and subsequent attacks.

Deep Dive & Mechanics

The vulnerability resides in the Grav admin panel’s page editing functionality. When an editor with limited permissions (e.g., only allowed to change basic content) sends a POST request to /admin/pages/{page_name}, the application fails to properly validate authorization for modifying critical fields. Specifically, the data[_json][header][form] parameter is not checked against the user’s permissions.

This parameter allows the attacker to modify the YAML frontmatter of a page, including the process section. The process section defines actions that occur after a form submission, such as saving data, sending emails, or executing Twig templates. By altering this, an attacker can:

• Change the form’s behavior to execute arbitrary Twig code (leading to Remote Code Execution).
• Redirect form submissions to external servers (data exfiltration).
• Modify form validation rules.

The attack flow:

1. Authenticate as an editor with basic permissions.
2. Send a POST request to /admin/pages/{page_name} with modified data[_json][header][form] containing malicious YAML.
3. The application processes the request without proper authorization checks, updating the page’s frontmatter.
4. The malicious process section is now active, affecting subsequent form submissions.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-1.8.0-beta.27): The authorization check in the admin controller likely only verifies permissions for basic content fields (e.g., data[content]) but does not validate changes to the data[_json][header][form] field. This allows an editor to modify the entire YAML frontmatter.

// Vulnerable: No check on _json[header][form]
public function savePage($pageName, $data) {
    // Only checks basic content permissions
    if (!$this->authorize('admin.pages.edit', $pageName)) {
        throw new \RuntimeException('Unauthorized');
    }
    // Directly saves all data including _json[header][form]
    $this->pages->save($pageName, $data);
}

Patched Code (1.8.0-beta.27): The patch adds a specific authorization check for modifying the form field within the YAML frontmatter. It ensures that only users with the admin.pages.edit.advanced permission can modify this field.

// Patched: Explicit check on _json[header][form]
public function savePage($pageName, $data) {
    if (!$this->authorize('admin.pages.edit', $pageName)) {
        throw new \RuntimeException('Unauthorized');
    }
    // Additional check for form field modification
    if (isset($data['_json']['header']['form'])) {
        if (!$this->authorize('admin.pages.edit.advanced', $pageName)) {
            throw new \RuntimeException('Unauthorized: Cannot modify form configuration');
        }
    }
    $this->pages->save($pageName, $data);
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install Grav CMS version 1.7.x (vulnerable) on a local server (e.g., using Docker).
2. Create an editor account with only admin.pages.edit permission (no admin.pages.edit.advanced).
3. Create a test page with a basic form.

Exploitation Steps:

1. Log in as the editor.
2. Craft a POST request to /admin/pages/test-page with the following payload (using curl or Burp Suite):

curl -X POST http://localhost/admin/pages/test-page \
  -H "Cookie: grav-admin-session=..." \
  -d "data[content]=test&data[_json][header][form][process][twig]=true&data[_json][header][form][process][save]=true"

3. The page’s frontmatter is now modified to include a process section that executes Twig templates and saves data.
4. Submit the form on the page to trigger the malicious process.

Expected Outcome: The attacker can now execute arbitrary Twig code, leading to RCE or data exfiltration.

Blue Team (Defensive)

Detection:

• Monitor POST requests to /admin/pages/* for unusual parameters, especially data[_json][header][form].
• Look for changes in YAML frontmatter that include process sections with unexpected actions (e.g., twig, redirect).
• Alert on editor accounts modifying form configuration without the admin.pages.edit.advanced permission.

Hunting:

• Search logs for requests containing _json[header][form] from non-admin users.
• Review page revisions for unauthorized changes to the process section.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /admin/pages/{page_name} with parameter data[_json][header][form].
• File System: Modified YAML frontmatter in page files (e.g., user/pages/01.home/default.md) containing a process section with unexpected keys like twig, redirect, or email.
• Logs: Admin panel access logs showing editor accounts modifying form configuration.
• Behavior: Unusual form submissions that execute Twig code or redirect to external URLs.

Detection Engineering

YARA Rule

rule Detect_Grav_CVE_2025_66301_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-66301 in Grav CMS by identifying malicious POST requests with _json[header][form] parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-66301"
    strings:
        $param = "_json[header][form]" ascii wide nocase
        $process = "process" ascii wide nocase
        $twig = "twig" ascii wide nocase
    condition:
        $param and $process and $twig
}

Sigma Rule

title: Grav CMS CVE-2025-66301 Authorization Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects POST requests to Grav admin pages with unauthorized modification of form configuration
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-66301
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-stem|startswith: '/admin/pages/'
        cs-uri-query|contains: '_json[header][form]'
    condition: selection
falsepositives:
    - Legitimate admin users with advanced permissions
level: high

Suricata Rule

alert http any any -> any any (msg:"Grav CMS CVE-2025-66301 Authorization Bypass Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/pages/"; http_uri; content:"_json[header][form]"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade Grav CMS to version 1.8.0-beta.27 or later.
2. Workaround: If upgrade is not possible, restrict editor permissions to the minimum required and monitor for unauthorized changes to page frontmatter.
3. Long-term: Implement strict authorization checks for all admin panel actions, especially those modifying YAML configuration. Use role-based access control (RBAC) to limit who can modify form behavior.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
5. Audit: Review all pages for unauthorized modifications to the process section in YAML frontmatter.

Valters IT