CVE-2021-47812: GravCMS RCE Vulnerability via Scheduler

CVE-2021-47812 Overview

CVE-2021-47812 is a critical unauthenticated remote code execution vulnerability affecting GravCMS version 1.10.7. This vulnerability allows remote attackers to write arbitrary YAML configuration files and execute PHP code through the scheduler endpoint without authentication. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs that execute system commands on the target server.

Critical Impact

Unauthenticated attackers can achieve full remote code execution on vulnerable GravCMS installations, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

• GravCMS 1.10.7
• Potentially earlier versions of GravCMS with the scheduler endpoint

Discovery Timeline

• 2026-01-16 - CVE-2021-47812 published to NVD
• 2026-01-16 - Last updated in NVD database

Technical Details for CVE-2021-47812

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), indicating that the scheduler endpoint in GravCMS 1.10.7 fails to properly authenticate or authorize incoming requests before processing them. The absence of authentication checks on this critical administrative function allows any remote attacker to interact with the scheduler and inject malicious configurations.

The exploitation mechanism centers around the scheduler endpoint's handling of the admin-nonce parameter. When crafted requests containing base64-encoded payloads are submitted to this endpoint, the application processes them without verifying the legitimacy of the request source. This allows attackers to write arbitrary YAML configuration data, which GravCMS subsequently parses and executes as part of its job scheduling functionality.

Root Cause

The root cause of CVE-2021-47812 is the missing authorization checks on the GravCMS scheduler endpoint. The application fails to validate whether incoming requests originate from authenticated administrative users before processing scheduler-related operations. This design flaw enables unauthenticated users to access functionality that should be restricted to privileged administrators only.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can send specially crafted HTTP requests to the vulnerable scheduler endpoint, exploiting the admin-nonce parameter to inject base64-encoded payloads. These payloads create custom scheduler jobs containing malicious PHP code or system commands. When the scheduler processes these jobs, the injected code executes with the privileges of the web server process, granting the attacker arbitrary code execution capabilities.

The attack sequence involves:

1. Identifying a vulnerable GravCMS 1.10.7 installation
2. Crafting a malicious payload with system commands encoded in base64
3. Sending the payload via the admin-nonce parameter to the scheduler endpoint
4. The scheduler writes the malicious YAML configuration
5. Upon job execution, the attacker's code runs on the server

For technical details on the exploitation methodology, refer to the Exploit-DB #49973 advisory and the VulnCheck Advisory on GravCMS.

Detection Methods for CVE-2021-47812

Indicators of Compromise

• Unexpected HTTP requests to the GravCMS scheduler endpoint containing base64-encoded data in the admin-nonce parameter
• Unauthorized modifications to YAML configuration files in the GravCMS installation directory
• Creation of suspicious scheduler jobs that were not configured by administrators
• Unusual process execution spawned from the web server process (e.g., www-data or apache)

Detection Strategies

• Monitor web server access logs for POST requests to scheduler-related endpoints with suspicious admin-nonce parameters
• Implement file integrity monitoring on GravCMS configuration directories to detect unauthorized YAML file modifications
• Deploy web application firewalls (WAF) with rules to detect base64-encoded command injection attempts
• Use endpoint detection and response (EDR) solutions to identify anomalous process trees originating from web server processes

Monitoring Recommendations

• Enable detailed logging for the GravCMS application and review for scheduler-related activities
• Configure alerts for any scheduler job creation or modification events
• Monitor network traffic for outbound connections from web servers that may indicate successful exploitation and command-and-control communication
• Implement behavioral analysis to detect unusual system command execution patterns

How to Mitigate CVE-2021-47812

Immediate Actions Required

• Identify all GravCMS installations running version 1.10.7 or earlier in your environment
• If upgrading is not immediately possible, restrict network access to the scheduler endpoint using firewall rules or web server configuration
• Review existing scheduler jobs and YAML configurations for any unauthorized modifications
• Monitor affected systems for signs of compromise while remediation is in progress

Patch Information

Organizations running vulnerable versions of GravCMS should upgrade to a patched version as soon as possible. Consult the Grav CMS Official Site for the latest security updates and version information. The VulnCheck Advisory on GravCMS provides additional details on the vulnerability and remediation guidance.

Workarounds

• Disable the scheduler functionality if it is not required for your GravCMS deployment
• Implement IP-based access controls to restrict access to administrative endpoints, including the scheduler
• Use a reverse proxy or WAF to block requests to the vulnerable endpoint until patching is complete
• Consider placing the GravCMS installation behind a VPN for additional access control

# Example Apache configuration to restrict scheduler endpoint access
<Location "/admin/scheduler">
    Require ip 192.168.1.0/24
    # Only allow access from trusted internal network
</Location>