CVE-2020-29555: Grav CMS Arbitrary File Deletion
Summary
CVE-2020-29555: Grav CMS Arbitrary File Deletion. Affects getgrav/grav across 2 version ranges.
< 1.6.30
>= 1.7.0-beta.1, <= 1.7.0-rc.17
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Grav CMS is an open-source flat-file CMS that allows users to create and manage websites. It is built on PHP and provides a flexible and easy-to-use platform for content management. However, a vulnerability has been discovered in Grav CMS versions 1.7.0-beta.1 through 1.7.0-rc.17 that allows an authenticated attacker to delete arbitrary files on the underlying server. This vulnerability can also be exploited by an unauthenticated attacker due to a lack of CSRF protection.
Vulnerability Detail
The vulnerability in Grav CMS arises from the BackupDelete functionality, which can be abused by an attacker to perform path traversal and delete arbitrary files on the server. By manipulating the path parameter, an authenticated attacker can traverse directories and delete files outside the intended scope. This can lead to unauthorized access, data loss, and potential disruption of the affected website. The lack of CSRF protection further exacerbates the vulnerability, allowing unauthenticated attackers to exploit it as well.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the BackupDelete functionality or restrict access to it. This can be achieved by modifying the configuration or access control settings of Grav CMS. However, it is important to note that this workaround may limit certain features and should only be considered until the CMS is updated to a fixed version.
Conclusion
The vulnerability in Grav CMS allows attackers to delete arbitrary files on the server, posing a significant risk to the security and integrity of the affected website. It is crucial to upgrade to the latest version of Grav CMS, enable CSRF protection, and follow best practices for website security. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getgrav/grav →
FAQ
Grav CMS is an open-source flat-file CMS that allows users to create and manage websites. It is built on PHP and provides a flexible and easy-to-use platform for content management.
Grav CMS versions 1.7.0-beta.1 through 1.7.0-rc.17 are affected by this vulnerability.
Yes, due to a lack of CSRF protection, an unauthenticated attacker can also exploit this vulnerability.
This vulnerability allows an attacker to delete arbitrary files on the server, which can lead to unauthorized access, data loss, and potential disruption of the affected website.
To mitigate the risk, it is recommended to upgrade Grav CMS to version 1.7.0 or later, enable CSRF protection, and keep the CMS and all its components up to date.
Related vulnerabilities
Recent vulnerabilities recorded for getgrav/grav.
