CVE-2021-21425: Grav Admin Plugin Auth Bypass Vulnerability

CVE-2021-21425 Overview

CVE-2021-21425 is a critical authentication bypass vulnerability in the Grav Admin Plugin, an HTML user interface that provides a way to configure Grav CMS and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute certain methods of the administrator controller without needing any credentials. Successful exploitation of this vulnerability results in arbitrary YAML file creation or modification of existing YAML files on the system.

Critical Impact

This vulnerability allows unauthenticated attackers to modify site configuration, create custom scheduler jobs, hijack administrator accounts, or execute operating system commands under the context of the web-server user.

Affected Products

• Grav Admin Plugin versions 1.10.7 and earlier
• getgrav grav-plugin-admin

Discovery Timeline

• 2021-04-07 - CVE-2021-21425 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-21425

Vulnerability Analysis

This vulnerability stems from improper access control in the Grav Admin Plugin's administrator controller. Certain controller methods lack proper authentication checks, allowing unauthenticated users to invoke privileged operations that should be restricted to authenticated administrators only.

The vulnerability enables attackers to write arbitrary content to YAML configuration files on the target system. Since Grav CMS relies heavily on YAML files for configuration, this arbitrary file write capability has severe security implications. Attackers can modify the site's configuration to inject malicious content, alter user credentials, or define custom scheduler jobs that execute arbitrary system commands.

The attack is particularly dangerous because it requires no prior authentication, making it trivially exploitable by any remote attacker with network access to the admin interface. The exploitation can lead to complete system compromise through remote code execution under the web server's user context.

Root Cause

The root cause of CVE-2021-21425 is improper access control (CWE-284) in the Grav Admin Plugin. Specific controller methods that perform sensitive operations such as YAML file creation and modification do not properly verify that the requesting user has been authenticated as an administrator. This allows unauthenticated requests to bypass intended security restrictions and directly invoke privileged functionality.

Attack Vector

The attack vector is network-based, requiring no user interaction and no prior privileges. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the /admin path of a vulnerable Grav CMS installation. The attack flow typically involves:

1. Identifying a vulnerable Grav CMS instance with the Admin Plugin version 1.10.7 or earlier
2. Sending unauthenticated requests to administrator controller endpoints that lack proper authentication checks
3. Writing malicious content to YAML configuration files to establish persistence or execute commands
4. Achieving remote code execution by leveraging scheduler functionality or other configuration-driven execution paths

For detailed technical analysis of the exploitation technique, refer to the Pentest Blog Analysis which documents the complete attack chain. Additional exploit details are available in the Packet Storm Exploit Report.

Detection Methods for CVE-2021-21425

Indicators of Compromise

• Unexpected modifications to YAML configuration files in the Grav CMS user directory
• New or altered scheduler job definitions that execute suspicious commands
• Unauthorized changes to administrator account credentials or site configuration
• Web server logs showing unauthenticated POST requests to /admin controller endpoints
• Creation of new YAML files with unusual names or content

Detection Strategies

• Monitor web server access logs for unauthenticated requests to /admin paths, particularly POST requests
• Implement file integrity monitoring for all YAML configuration files within the Grav CMS installation
• Deploy web application firewall (WAF) rules to detect and block exploitation attempts targeting the admin controller
• Review scheduler configuration files for unauthorized job definitions that may indicate post-exploitation persistence

Monitoring Recommendations

• Configure real-time alerting for any modifications to Grav CMS configuration files
• Enable verbose logging on web servers hosting Grav CMS installations
• Implement network monitoring to detect suspicious traffic patterns targeting CMS admin interfaces
• Regularly audit administrator accounts and access logs for signs of unauthorized access

How to Mitigate CVE-2021-21425

Immediate Actions Required

• Update Grav Admin Plugin to version 1.10.8 or later immediately
• Block access to the /admin path from untrusted network sources using firewall rules or web server configuration
• Review all YAML configuration files for unauthorized modifications
• Audit scheduler jobs and administrator accounts for signs of compromise
• Consider taking affected systems offline until patches are applied if immediate patching is not possible

Patch Information

The vulnerability has been fixed in Grav Admin Plugin version 1.10.8. Administrators should upgrade to this version or later to remediate the vulnerability. For additional details, refer to the GitHub Security Advisory.

Workarounds

• Restrict access to the /admin path using IP whitelisting in web server configuration
• Place the Grav CMS admin interface behind a VPN or other network-level access control
• Disable the Admin Plugin entirely if it is not required for operations
• Implement a reverse proxy with authentication requirements in front of the admin interface

# Apache configuration example - restrict admin access to trusted IPs
<Location /admin>
    Require ip 10.0.0.0/8
    Require ip 192.168.1.0/24
    # Deny all other access
</Location>

# Nginx configuration example - restrict admin access
location /admin {
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
}