Skip to content
Log inStart free trial

GHSA-gq3g-666w-7h85 CVE-2025-66304

Grav Exposes Password Hashes Leading to privilege escalation

High Packagist
Severity
6.2 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.41%
Chance of exploitation in the next 30 days. Higher than 35.31% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-201 Insertion of Sensitive Information Into Sent Data
Fix
1.8.0-beta.27
Upgrade getgrav/grav to this version or later

Description

Exposure of Password Hashes Leading to privilege escalation

Severity Rating: Medium

Vector: Privilege Escalation

CVE: XXX

CWE: 200 - Exposure of Sensitive Information

CVSS Score: 6.2

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

Analysis

It was observed that if a users is given read access on the user account management section of the admin panel can view the password hashes of all users, including the admin user. This exposure can potentially lead to privilege escalation if an attacker can crack these password hashes.

An attacker with read access can:

  • View and potentially crack the password hashes.
  • Gain administrative access by cracking the admin password hash.
  • Escalate privileges and compromise the entire admin panel.

Proof of Concept

  1. Give read access to user accounts to a random user as shown in the following figures: grav0 grav2

  2. Log in to the admin panel with an account that has read access to user accounts and navigate to the user account management section.

  3. Go to the admin profile http://127.0.0.1/admin/accounts/users/admin; The password is not display. Try inspecting the page source code as shown in the following figures: grav2-1

    You can see that it match the hash that is in the admin.yaml file : Compare to the hash in database of the admin

  4. Crack the hash as shown in the following figure, the algorithm use here is bcrypt:

grav3

Workarounds

No workaround is currently known

Timeline

2024-07-24 Issue identified

2024-09-27 Vendor contacted

About X41 D-Sec GmbH

X41 is an expert provider for application security services. Having extensive industry experience and expertise in the area of information security, a strong core security team of world class security experts enables X41 to perform premium security services.

Fields of expertise in the area of application security are security centered code reviews, binary reverse engineering and vulnerability discovery. Custom research and IT security consulting and support services are core competencies of X41.

Affected versions

Packagist

PackageVulnerableFixed in
getgrav/grav
< 1.8.0-beta.27
1.8.0-beta.27

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

getgrav/grav Packagist → 1.8.0-beta.27

composer
composer require getgrav/grav:^1.8.0-beta.27

Severity breakdown

CVSS 3.1 6.2

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack vector
Network
Attack complexity
High
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
Low

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

How to prevent it
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

CWE-201: Insertion of Sensitive Information Into Sent Data

The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

How to prevent it
  • Requirements: Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
  • Implementation: Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.
  • System Configuration: Setup default error messages so that unexpected errors do not disclose sensitive information.
  • Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-xjw5-q542-3vmr
Grav: config_denied_paths default list omits `system`, exposing real secrets (e.g. system.cache.redis.password) via the Twig sandbox when config_access is enabled
High Also affects getgrav/grav
GHSA-3jhr-mxmx-38cx
Grav: UserInterface offsetget/offsetexists allow-listed in Twig sandbox let editor-authored content leak hashed_password and 2FA secrets via offsetGet()
Medium Also affects getgrav/grav
GHSA-9ccq-2jfg-qw33
Grav: Origin validation bypass in Uri::referrer() and Pages::referrerRoute() via unanchored prefix match
Critical Also affects getgrav/grav
GHSA-38p6-h87p-r4cg
Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection
Medium Also affects getgrav/grav
GHSA-p597-crqc-m349
Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by config_denied_paths
Medium Also affects getgrav/grav
GHSA-47ch-6w46-6xm7
Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content
Medium Also affects getgrav/grav
GHSA-jq29-c7v8-rg55
Grav: Path Traversal in MediaUploadTrait::deleteFile() Allows Arbitrary File Deletion
High Also affects getgrav/grav
GHSA-8hgv-xc77-jmcr
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
Medium Also affects getgrav/grav
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor