CyberRota Analysis
AI-GeneratedThe Grav API Plugin prior to version 1.0.6 is vulnerable due to insufficient validation of webhook URLs and improper cURL initialization, allowing attackers with api.webhooks.write permissions to exploit these weaknesses. This could lead to unauthorized access to local files, pivoting to internal services, and potential data exfiltration. Organizations using the Grav CMS should prioritize upgrading to version 1.0.6 to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin WebhookController.php accepts webhook URLs after only FILTER_VALIDATE_URL syntax validation, and WebhookDispatcher.php initializes cURL without CURLOPT_PROTOCOLS or CURLOPT_REDIR_PROTOCOLS restrictions. An account with api.webhooks.write can submit file, dict, gopher, private-network, or link-local targets, retrieve local files and delivery response bodies, and pivot requests to internal services or cloud metadata endpoints. This issue is fixed in version 1.0.6.