CyberRota Analysis
AI-GeneratedThe Grav CMS's scheduler-webhook plugin is vulnerable due to an authentication bypass in the webhook token check, allowing unauthenticated remote attackers to trigger scheduled jobs by sending a request to the webhook endpoint. While attackers cannot execute arbitrary commands, they can control the timing and selection of existing jobs, which could lead to unintended consequences if those jobs perform sensitive operations. Organizations using the Grav CMS with the scheduler-webhook plugin enabled should prioritize addressing this vulnerability, especially if they have not configured a webhook token.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav CMS's scheduler-webhook plugin contains an authentication bypass in the webhook token check. When the webhook feature is enabled but no webhookToken is configured, a compound conditional short-circuits and skips token validation, so an unauthenticated remote attacker who can reach POST /scheduler/webhook can trigger the operator's already-configured scheduled jobs by sending a single request. The primitive is triggering-existing-jobs, not attacker-chosen command execution: the attacker controls when the jobs run and which one runs (via ?job=), but does not control what the jobs do. Code execution follows only when the operator has configured a job that shells out, and even then the attacker controls timing rather than payload. Not a default-install issue: reaching the endpoint requires the separate scheduler-webhook GPM plugin to be installed, scheduler.modern.webhook.enabled to be true (default false), and no webhookToken to be configured; a stock Grav or Grav-Admin install exposes nothing here.