Horizon Alert
Summary of the vulnerability and why it matters
An unauthenticated user could gain administrative control over the Grav web platform by exploiting a weakness in the Login plugin's registration process. This allows them to bypass normal security checks and assign themselves the highest level of privileges. Teams should pay attention because this could allow unauthorized individuals to take over their website.
- Anyone can become an administrator.
- This affects Grav websites with registration enabled.
- An attacker can gain full control.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker could exploit this flaw by sending a crafted POST request to the registration endpoint. If registration is enabled and the attacker-controlled fields are configured as allowed, they can inject fields to grant themselves administrative privileges. This allows them to fully compromise the Grav instance.
- Registration enabled is required.
- Target the Login plugin's registration.
- Inject admin privileges via POST data.
Live Threat
Current exploitation, exposure, and threat context
This vulnerability in Grav's login plugin allows unauthenticated users to gain admin privileges if registration is enabled and configured to accept specific fields. This type of vulnerability is attractive to attackers as it offers a direct path to high-level access on a web platform without needing prior authentication. The fact that it's a critical severity, network-exploitable flaw on a web platform increases its appeal.
- Exploitable remotely over network.
- Fixed version released recently.
- KEV listed status is unknown.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize blocking any unauthenticated registration attempts and immediately upgrade the Login plugin to version 2.0.0-beta.2 to address the critical privilege escalation vulnerability. If upgrading is not immediately feasible, disable the user registration feature entirely to prevent exploitation.
- Upgrade Login plugin to 2.0.0-beta.2.
- Disable user registration if upgrade is delayed.
- Monitor for unauthorized admin account creation.
