-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability, identified as GHSA-gq3g-666w-7h85, allowed users with read access to the user account management section to view the password hashes of all users. This was due to the insecure serialization of user objects, which included sensitive data like hashed_password.
The patch addresses this by overriding the jsonSerialize method in two key classes: Grav\Common\Flex\Types\Users\UserObject and Grav\Common\User\DataUser\User. The jsonSerialize method is invoked when json_encode() is called on an object, which is a common practice for preparing data for API responses.
Before the fix, these classes relied on a parent's jsonSerialize implementation, which simply converted all object properties to an array, thus exposing the password hash. The patch introduces a specific implementation in both classes that calls the parent method and then explicitly unsets the hashed_password, secret, and twofa_secret fields from the resulting array. This ensures that sensitive data is not included in the JSON output sent to the client, mitigating the information disclosure vulnerability.
Grav\Common\Flex\Types\Users\UserObject::jsonSerializesystem/src/Grav/Common/Flex/Types/Users/UserObject.php
Grav\Common\User\DataUser\User::jsonSerializesystem/src/Grav/Common/User/DataUser/User.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |
A Semantic Attack on Google Gemini - Read the Latest Research