Grav API Plugin Unrestricted File Upload Vulnerability in Avatar Endpoint

A vulnerability allowing unrestricted file uploads has been identified in the Grav API plugin (getgrav/grav-plugin-api) version 1.0.0. The issue resides in the avatar upload endpoint, which only validates the client's declared MIME type, allowing authenticated users to upload arbitrary content, including PHP scripts and SVG files with embedded JavaScript. The uploaded files are stored on the server under user/accounts/avatars/ with predictable filenames. While direct access to these files is restricted by .htaccess, they remain on disk, could be included in backups, and might lead to remote code execution or stored cross-site scripting under certain conditions.

Impact

Exploitation of this vulnerability allows authenticated users to upload dangerous files that could be executed as code or cause cross-site scripting attacks, depending on server configuration.

Reproduction

To reproduce this vulnerability, an authenticated user can upload a file to the avatar endpoint by declaring a MIME type that starts with 'image/'. The uploaded file will be stored in the user/accounts/avatars/ directory with a predictable filename. Despite being blocked from direct HTTP access, the file will persist on the server and could be executed or cause cross-site scripting if the server is misconfigured.

Remediation

Users are advised to update to Grav API plugin version 1.0.1, which addresses this vulnerability.