Cross-site Scripting (XSS) - Stored in getgrav/grav-plugin-admin

Valid

Reported on

Dec 19th 2021


Description

grav-plugin-admin 1.10.25 has a Stored-XSS vulnerability that is executed when metadata information of a file whose name contains javascript are shown.

Proof of Concept

1 - After installing grav+admin browse to http://127.0.0.1/admin/pages/home.

2 - Create a file named as follows: <script>alert()</script>.png

3 - In the page media section select the file created at the point 2. The file is uploaded and is visible in the page media area.

4 - Everytime the admin hover the mouse pointer on the picture and clicks on the metadata icons the javascript code injected in the filename is executed.

Impact

This vulnerability is capable of executing arbitrary javascript in the victim's browser.

We are processing your report and will contact the getgrav/grav-plugin-admin team within 24 hours. 5 months ago
We have contacted a member of the getgrav/grav-plugin-admin team and are waiting to hear back 5 months ago
We have sent a follow up to the getgrav/grav-plugin-admin team. We will try again in 7 days. 5 months ago
We have sent a second follow up to the getgrav/grav-plugin-admin team. We will try again in 10 days. 5 months ago
We have sent a third and final follow up to the getgrav/grav-plugin-admin team. This report is now considered stale. 4 months ago
Djamil Legato validated this vulnerability 4 months ago
midist0xf has been awarded the disclosure bounty
The fix bounty is now up for grabs
Djamil Legato confirmed that a fix has been merged on 4e6e5c 4 months ago
Djamil Legato has been awarded the fix bounty
midist0xf
3 months ago

Researcher


Hi Djamil, is it ok for you if huntr starts the process to request a CVE related to this vulnerability? Thanks

to join this conversation