Horizon Alert
Summary of the vulnerability and why it matters
This advisory details a critical security vulnerability in the Grav API plugin that could allow unauthenticated attackers to exhaust server disk space or overload the cache. For authenticated users with specific permissions, the flaw also enables unauthorized overwriting of content or creation of pages that bypass established rules. The primary concern is confirming the plugin's relevance and exposure within your environment.
- Attackers can overload server resources.
- Leadership should remember potential for data compromise.
- Confirm relevance and assess exposure.
Attack Path
How an attacker could exploit the issue
An attacker could initiate a series of requests to the Grav API plugin, starting from the internet, to exploit vulnerabilities in how it handles translations and page content. By sending well-formed requests to the `GET /api/v1/translations/{lang}` endpoint, an unauthenticated attacker can cause the plugin to cache large amounts of data, potentially filling up disk space or memory. Alternatively, an attacker who has authenticated access with `api.pages.write` permissions could abuse the sync and batch copy endpoints to overwrite existing content or create new pages that violate access rules.
- Unauthenticated access to API
- Sending crafted language code requests
- Disk space exhaustion or content manipulation
Live Threat
Current exploitation, exposure, and threat context
This vulnerability could affect the disk space or APCu cache of a Grav CMS installation. Unauthenticated attackers can exhaust disk space by repeatedly requesting translation dictionaries. Accounts with API write permissions could potentially overwrite existing translations or create unauthorized pages, bypassing page access rules.
- Disk space and cache may be exhausted.
- Malicious requests can fill storage.
- Service disruption or unauthorized content.
Operational Fix
Recommended remediation, mitigation, and detection steps
Grav API plugin instances accessible via the internet are at risk. Application owners and platform teams should prioritize identifying deployments of this plugin, confirming exposure and business criticality, and then coordinating remediation with the vendor.
- Identify Grav API plugin instances and exposure.
- Confirm accountable owners and business criticality.
- Plan remediation based on vendor coordination.
