CyberRota Analysis
AI-GeneratedThe Grav API Plugin for Grav CMS is vulnerable due to the JwtAuthenticator::extractBearerToken() method, which improperly accepts JWTs from the token URL query parameter on all /api/v1 routes, including those that modify data. This flaw can lead to exposure of valid access tokens in logs and browser histories, allowing unauthorized parties to exploit the API with the owner's privileges. Organizations using affected versions of the Grav API Plugin should prioritize upgrading to version 1.0.0-rc.16 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.0-rc.16, the Grav API plugin JwtAuthenticator::extractBearerToken() accepts a JWT from the token URL query parameter on every /api/v1 route, including state-changing endpoints. Request URLs consequently expose valid access tokens through Apache, proxy, and CDN logs, browser history, and Referer headers, allowing a party with access to those records to reuse the token with the owner's API privileges. This issue is fixed in version 1.0.0-rc.16.