-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is a Denial of Service (DoS) in the Grav admin panel, caused by the application's failure to properly sanitize and handle malformed cron expressions. The core of the issue lies in the use of CronExpression::factory(), which throws an InvalidArgumentException when provided with an invalid cron string.
The user can introduce a malicious string, such as a single quote ('), into the scheduled_at parameter for a scheduled task (like a backup) via the /admin/tools endpoint. This invalid expression is saved to a configuration file (backup.yaml).
When the admin panel or a CLI command later attempts to read and process this scheduled job, it calls functions like Grav\Common\Scheduler\Job::getCronExpression() or Grav\Common\Scheduler\IntervalTrait::at(). These functions, prior to the patch, would call CronExpression::factory() without any error handling. The resulting unhandled InvalidArgumentException would propagate up the stack, causing the application to crash and rendering the admin panel inaccessible until the invalid data is manually removed from the configuration file.
The patch addresses this by wrapping all calls to CronExpression::factory() within try-catch blocks. This ensures that invalid cron expressions are handled gracefully by returning null instead of crashing the application, thus preventing the Denial of Service.
Grav\Common\Scheduler\IntervalTrait::atsystem/src/Grav/Common/Scheduler/IntervalTrait.php
Grav\Common\Scheduler\Job::getCronExpressionsystem/src/Grav/Common/Scheduler/Job.php
Grav\Common\Twig\Extension\GravExtension::cronFuncsystem/src/Grav/Common/Twig/Extension/GravExtension.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
No workaround is currently known
2024-07-24 Issue identified
2024-09-27 Vendor contacted
X41 is an expert provider for application security services. Having extensive industry experience and expertise in the area of information security, a strong core security team of world class security experts enables X41 to perform premium security services.
Fields of expertise in the area of application security are security centered code reviews, binary reverse engineering and vulnerability discovery. Custom research and IT security consulting and support services are core competencies of X41.
Ongoing coverage of React2Shell