Grav Stored CSS Injection Vulnerability via Markdown Image Resize Action

A stored CSS injection vulnerability has been identified in Grav versions prior to 2.0.0, affecting through 2.0.0-rc.9 and the 2.0 branch. The vulnerability arises in the Markdown image 'resize()' media action, where caller-controlled values are directly written into the image's style attributes. This allows a lower-privileged content editor to inject CSS declarations that are rendered when a higher-privileged user views the page or preview. The issue does not require JavaScript execution but enables UI redress and content manipulation attacks, such as creating a full-viewport fixed overlay.

Impact

Exploitation of this vulnerability allows for stored CSS injection in rendered content, with risks of UI redress and content manipulation in higher-privileged user sessions.

Reproduction

To reproduce this vulnerability, a lower-privileged content editor can upload an image and include a crafted URL in the Markdown 'resize' parameters. This URL should contain CSS declarations, such as 'position:fixed' and 'z-index' values, delimited by semicolons. When the image is rendered, the injected styles will be applied, creating an overlay effect. This can also be tested by directly calling the 'resize' method with a similar payload, which will bypass the application's normal sanitization processes and inject the CSS into the style attribute of the image.

Remediation

Users can update to Grav version 2.0.0, where this vulnerability has been fixed.