CVE-2024-34082: Grav Vulnerable to Arbitrary File Read to Account Takeover

May 15, 2024

A low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/*.yaml. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password.

References

github.com/advisories/GHSA-f8v5-jmfh-pr69
github.com/getgrav/grav
github.com/getgrav/grav/commit/b6bba9eb99bf8cb55b8fa8d23f18873ca594e348
github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69
nvd.nist.gov/vuln/detail/CVE-2024-34082

Code Behaviors & Features

Detect and mitigate CVE-2024-34082 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →