CVE-2018-5233: Grav CMS Cross-site scripting (XSS) vulnerability
Summary
CVE-2018-5233: Grav CMS Cross-site scripting (XSS) vulnerability. Affects getgrav/grav versions < 1.3.0. Fixed in 1.3.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grav CMS is an open-source content management system designed to be fast, simple, and flexible. It utilizes the Twig templating engine for rendering web pages. The vulnerability identified as CVE-2018-5233 affects Grav CMS versions prior to 1.3.0. This vulnerability allows remote attackers to inject arbitrary web script or HTML through the PATH_INFO to the admin/tools endpoint.
Vulnerability Detail
The CVE-2018-5233 vulnerability in Grav CMS arises due to a lack of proper input sanitization in the system/src/Grav/Common/Twig/Twig.php file. By manipulating the PATH_INFO parameter, an attacker can inject malicious code or HTML into the admin/tools endpoint. This can lead to cross-site scripting (XSS) attacks, where unsuspecting users may execute the injected code, potentially compromising their accounts or exposing sensitive information.
How To Fix
Minimum fixed version
1.3.0
This is the first release that contains the fix.
composer require getgrav/grav:1.3.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually sanitizing the PATH_INFO parameter in the affected file (system/src/Grav/Common/Twig/Twig.php). This can be achieved by using a reliable HTML sanitizer library or implementing custom input validation and sanitization functions. Here is an example of how the code can be modified:
// Sanitize PATH_INFO
$pathInfo = sanitize($pathInfo);
Conclusion
The CVE-2018-5233 vulnerability in Grav CMS exposes users to potential cross-site scripting (XSS) attacks. It is crucial to upgrade to version 1.3.0 or later to mitigate this vulnerability. If immediate upgrading is not possible, implementing a temporary workaround by sanitizing the PATH_INFO parameter can provide some protection. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getgrav/grav →
FAQ
The vulnerability allows attackers to inject malicious code or HTML into the Grav CMS admin/tools endpoint. This can lead to cross-site scripting (XSS) attacks, potentially compromising user accounts or exposing sensitive information.
Grav CMS versions prior to 1.3.0 are affected by this vulnerability.
Yes, upgrading Grav CMS to version 1.3.0 or later fixes this vulnerability.
A temporary workaround involves manually sanitizing the PATH_INFO parameter in the affected file (system/src/Grav/Common/Twig/Twig.php). This can be achieved by using an HTML sanitizer library or implementing custom input validation and sanitization functions.
You can find more information about the vulnerability in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-977g-93f5-rqjx/GHSA-977g-93f5-rqjx.json
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.