CyberRota Analysis
AI-GeneratedThe Grav API plugin prior to version 1.0.0-rc.16 is vulnerable due to its handling of JWT access tokens via the URL query parameter, which leads to potential exposure in web server logs and browser history. This flaw allows unauthorized access to sensitive API functionalities, including configuration and user data manipulation, posing a significant risk to system integrity. Organizations using this plugin should prioritize immediate updates to mitigate the risk of token leakage and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.