Nicl4Ssic

**Name of the Vulnerable Software and Affected Versions** Grav form plugin versions prior to 9.1.13 **Description** An open redirect issue exists where the redirect process action evaluates user-supplied form data within Twig expressions. Because the `Grav::redirect()` function accepts external URLs without validating the origin, an unauthenticated user can submit a malicious value through an attacker-controllable field. This occurs when a form blueprint defines a redirect target using the `form.value()` function, such as `redirect: "{{ form.value('next') }}"`, allowing the attacker to trigger a 302 redirect to an arbitrary external site for phishing purposes. **Recommendations** Update to version 9.1.13 or later.

**Name of the Vulnerable Software and Affected Versions** Grav versions prior to 2.0.4 **Description** A two-factor authentication bypass exists in the login plugin. The `regenerate2FASecret` task fails to verify authorization during the pending TOTP (Time-based One-Time Password) challenge window, checking only if the user exists. An attacker possessing the victim's password can invoke this task without a CSRF nonce to replace the 2FA secret with a value of their choice. This allows the attacker to generate a valid TOTP code and complete the authentication process, effectively reducing the security of the account to password-only protection. **Recommendations** Update Grav to version 2.0.4 or later. As a temporary mitigation, restrict access to the `regenerate2FASecret` task.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.6 **Description** An authorization bypass exists because the `ApiKeyAuthenticator` class fails to read or enforce the restricted scopes array when API keys are created. Consequently, a key intended for limited access, such as read-only, can be used to perform any write, delete, or administrative operation that the owning user is authorized to execute, as the system returns the full account object of the user. **Recommendations** Update Grav API plugin to version 1.0.6.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.0-rc.16 **Description** The plugin accepts JWT (JSON Web Token) access tokens via the `token` URL query parameter on every API route through the `JwtAuthenticator::extractBearerToken` fallback. This behavior causes tokens to be logged in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs. An attacker with access to a leaked token can gain unauthorized API access to read configuration and user data, create admin accounts, modify system settings, and delete pages. **Recommendations** Update the Grav API plugin to version 1.0.0-rc.16 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.0-rc.16 **Description** The plugin uses a default Cross-Origin Resource Sharing (CORS) configuration that sets the Access-Control-Allow-Origin header to `*` on all responses, including preflight (OPTIONS) responses and authenticated endpoints. This configuration allows any malicious website to issue authenticated cross-origin requests if an attacker obtains a valid access token through methods such as log leakage, browser history, network capture, or Referer headers. The plugin accepts credentials via the `Authorization` and `X-API-Token` headers, which are set programmatically by JavaScript. An attacker can leverage this to read sensitive data or perform write operations on behalf of the user associated with the token. **Recommendations** Update Grav API plugin to version 1.0.0-rc.16.

**Name of the Vulnerable Software and Affected Versions** Grav Admin2 plugin versions prior to 2.0.4 **Description** The plugin embeds a global JavaScript variable `window. GRAV CONFIG ` in the Admin2 SPA bootstrap page at the '/grav/admin' endpoint and its subroutes. This object is returned in every unauthenticated response and discloses the server URL, API prefix, admin base path, runtime environment type, and exact Grav and Admin2 version numbers. This allows an unauthenticated attacker to fingerprint the deployment and select version-specific exploits without reconnaissance. **Recommendations** Update the Grav Admin2 plugin to version 2.0.4 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.0-rc.16 **Description** The plugin accepts JSON Web Tokens (JWT) through the `token` URL query parameter and returns an Access-Control-Allow-Origin: * header. This configuration allows unauthenticated attackers to perform fully authenticated cross-origin API requests from malicious websites. If a JWT token is leaked via access logs, proxy logs, browser history, or Referrer headers, an attacker can exfiltrate sensitive user and configuration data or create persistent super-admin backdoor accounts. **Recommendations** Update Grav API plugin to version 1.0.0-rc.16 or later.

**Name of the Vulnerable Software and Affected Versions** Grav API plugin versions prior to 1.0.1 **Description** An unrestricted file upload issue exists in the avatar upload endpoint '/api/v1/users/user/avatar'. The system only validates the client-declared MIME type using `getClientMediaType` to check if it begins with 'image/', without inspecting actual file content or restricting extensions. This allows authenticated users to upload arbitrary content, such as PHP code, SVG files with embedded JavaScript, or polyglot payloads, to the 'user/accounts/avatars/' directory with predictable filenames. While .htaccess blocks direct HTTP access to these files, their persistence on disk could enable remote code execution or stored Cross-Site Scripting (XSS) if a path traversal flaw or server misconfiguration is present. **Recommendations** Update to version 1.0.1.