Grav API Plugin Cross-Origin Authentication Bypass Vulnerability Allowing Admin Account Takeover

A vulnerability in the Grav API plugin, affecting versions through v1.0.0-rc.15, allows unauthenticated attackers to make authenticated cross-origin API requests by exploiting a CORS wildcard and JWT token leakage via the URL query parameter. This vulnerability enables the creation of persistent backdoor super-admin accounts and the exfiltration of sensitive configuration and user data. The issue arises because the plugin accepts JWT tokens in the query string of every API route, and the CORS policy allows all origins to read the response, bypassing normal credential restrictions.

Impact

Exploitation of this vulnerability allows for cross-origin authenticated API access, enabling complete administrative takeover. An attacker can create a backdoor super-admin account that survives token rotation and password changes, while also exfiltrating all site configuration, user data, and page content.

Reproduction

To reproduce this vulnerability, first capture a JWT token from an Apache access log or another source where the token is leaked. Then, verify that the token works by sending a request to an API endpoint with the token included in the query parameter. Finally, check that the CORS policy allows cross-origin reads by sending a request from a different origin and confirming that the response can be accessed.

Remediation

Users are advised to update to Grav API plugin version v1.0.0-rc.16 or later.