Horizon Alert
Summary of the vulnerability and why it matters
An authenticated user with administrative privileges on the Grav platform can upload a crafted ZIP file to gain remote code execution. While Grav prevents direct uploads of malicious PHP files, it does not properly inspect the contents of ZIP archives, allowing the extraction and execution of arbitrary code. This issue is significant because it can lead to a complete compromise of the server.
- Admin access needed.
- Can lead to server takeover.
- Affects Grav CMS.
Attack Path
How an attacker could exploit the issue
An attacker with administrative privileges in Grav CMS could exploit this by uploading a malicious ZIP file disguised as a plugin through the "Direct Install" tool. The system's failure to properly scan the contents of the ZIP archive would allow a malicious PHP file to be extracted and executed, leading to Remote Code Execution.
- Authenticated administrator access needed.
- Uploading ZIP via Direct Install.
- Targets Grav CMS prior to 2.0.0-beta.2.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability allows authenticated administrators to achieve RCE through a crafted ZIP file, bypassing intended .php upload restrictions. While this requires administrative access, which is a significant hurdle, the severity of RCE can make it an attractive target for sophisticated attackers seeking to compromise systems with existing privileged access. The lack of immediate public exploit or KEV listing suggests it is not yet widely weaponized, but this could change.
- Authentication required for exploitation.
- No public exploit observed.
- Not KEV listed.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Teams should prioritize immediate containment for Grav instances running versions prior to 2.0.0-beta.2, especially if administrative access is suspected or confirmed. The critical RCE vulnerability via crafted ZIP uploads requires strict attention to prevent full system compromise.
- Block all ZIP uploads to the "Direct Install" tool.
- Upgrade Grav to version 2.0.0-beta.2 or later.
- Monitor for unusual file creation or process execution.
