CVE-2021-21425

🗓️ 07 Apr 2021 18:20:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 150 Views🌐 WEB

Grav Admin Plugin HTML UI allows unauthenticated user to execute administrator controller methods, leading to arbitrary YAML file creation or content change. Fixed in v1.10.8

Reporter	Title	Published	Views	Family All 17
0day.today	GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update Exploit	21 Apr 202100:00	–	zdt
0day.today	GravCMS 1.10.7 Remote Command Execution Exploit	4 May 202100:00	–	zdt
GithubExploit	Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin	15 May 202617:42	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin	13 Nov 202400:30	–	githubexploit
GithubExploit	Exploit for Improper Access Control in Getgrav Grav-Plugin-Admin	21 Jan 202604:45	–	githubexploit
Circl	CVE-2021-21425	21 Apr 202100:00	–	circl
CNNVD	Grav 安全漏洞	7 Apr 202100:00	–	cnnvd
Cvelist	CVE-2021-21425 Unauthenticated Arbitrary YAML Write/Update leads to Code Execution	7 Apr 202118:20	–	cvelist
Exploit DB	GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)	21 Apr 202100:00	–	exploitdb
Metasploit	GravCMS Remote Command Execution	4 May 202117:41	–	metasploit

NVD

Vulners

Node

getgrav grav-plugin-adminRange<1.10.8

[
  {
    "product": "grav-plugin-admin",
    "vendor": "getgrav",
    "versions": [
      {
        "status": "affected",
        "version": "<= 1.10.7"
      }
    ]
  }
]

Source	Link
pentest	www.pentest.blog/unexpected-journey-7-gravcms-unauthenticated-arbitrary-yaml-write-update-leads-to-code-execution/
packetstormsecurity	www.packetstormsecurity.com/files/162457/GravCMS-1.10.7-Remote-Command-Execution.html
packetstormsecurity	www.packetstormsecurity.com/files/162283/GravCMS-1.10.7-Remote-Command-Execution.html
github	www.github.com/getgrav/grav-plugin-admin/security/advisories/GHSA-6f53-6qgv-39pj

Parameter	Position	Path	Description	CWE
admin-nonce	path	admin	Unauthenticated access to Grav Admin UI to obtain admin nonce/cookie for further exploitation.	CWE-284
cookie	path	admin	Unauthenticated access to Grav Admin UI to obtain admin nonce/cookie for further exploitation.	CWE-284
hidden inputs	path	admin	Unauthenticated access to Grav Admin UI to obtain admin nonce/cookie for further exploitation.	CWE-284
data[custom_jobs][<name>][command]	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284
data[custom_jobs][<name>][args]	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284
data[custom_jobs][<name>][at]	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284
data[custom_jobs][<name>][output]	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284
data[status][<name>]	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284
data[custom_jobs][<name>][output_mode]	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284
admin-nonce	request body	admin/config/scheduler	Scheduler configuration write enables arbitrary command execution by adding a custom_job that runs a shell command, enabling RCE.	CWE-284

21 Nov 2024 05:48Current

9.4High risk

Vulners AI Score9.4

CVSS 27.5

CVSS 3.19.3 - 9.8

EPSS0.91639

CWE-284