-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a Denial of Service (DoS) in Grav CMS, originating from improper input validation of the 'Supported' languages setting in the admin panel. The root cause is twofold:
Input Injection: The Grav\Common\Language\Language->setLanguages function, which processes the 'Supported' languages from the configuration, failed to sanitize the input. It directly stored user-provided strings, allowing an attacker to inject characters with special meaning in regular expressions, such as a forward slash (/).
Regex Failure: The Grav\Common\Language\Language->setActiveFromUri function later retrieves this list of languages to dynamically construct a regular expression. When the unsanitized, malicious string is included, it corrupts the regex pattern. For example, if the language list is en|/|fr, the regex becomes /(^\/(en|/|fr))(?:\/|\?|$)/i. The unescaped / is interpreted as the closing delimiter, causing the preg_match() function to fail with an 'Unknown modifier' error, crashing the application.
The patch resolves this by first adding strict validation in setLanguages to only allow valid language codes. Secondly, as a defense-in-depth measure, the patch modifies setActiveFromUri to ensure that any special characters that might be used as a regex delimiter are properly escaped when constructing the regex, preventing the crash.
Grav\Common\Language\Language->setLanguagessystem/src/Grav/Common/Language/Language.php
Grav\Common\Language\Language->setActiveFromUrisystem/src/Grav/Common/Language/Language.php
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 1.8.0-beta.27 | 1.8.0-beta.27 |