CyberRota Analysis
AI-GeneratedGrav versions prior to 2.0.4 are vulnerable due to insufficient restrictions on cURL protocols in webhook dispatch, enabling authenticated users with the appropriate permissions to create webhooks that exploit file://, dict://, or gopher:// URLs. This vulnerability can lead to unauthorized access to local files, exposure of sensitive process information, and potential lateral movement within internal services. Organizations using Grav should prioritize patching to mitigate the risk of exploitation by malicious actors.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.