CyberRota Analysis
AI-GeneratedThe Grav API plugin versions prior to 1.0.13 are vulnerable due to inadequate enforcement of API key scope restrictions, enabling attackers with a scoped api.config.write key to inject arbitrary commands into the scheduler's custom jobs. This flaw allows for remote code execution, posing a critical risk to the integrity and security of affected systems. Organizations utilizing this plugin should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. Attackers with a scoped api.config.write key can inject arbitrary commands into scheduler.custom_jobs that execute via Symfony Process for remote code execution.