Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 2.0.16 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from an insufficient origin validation mechanism in Grav CMS, specifically within the Uri::referrer() and Pages::referrerRoute() methods. Both functions attempt to verify if an incoming request's Referer header originates from the site by using str_starts_with($referrer, $base) (or $root). The critical flaw is that $base (or $root) represents the site's absolute root URL without a trailing slash (e.g., https://example.com).
Because str_starts_with performs an unanchored prefix match, any Referer header that begins with the exact string of the base URL is considered valid. This allows an attacker to register a domain like https://example.com.attacker.tld or https://example.com-attacker.tld. When a victim visits a page on such an attacker-controlled domain, and that page makes a request to the legitimate Grav CMS site, the browser sends the attacker's domain as the Referer header. Since https://example.com.attacker.tld starts with https://example.com, the vulnerable str_starts_with check incorrectly validates it as same-origin.
This bypass can lead to various security implications, including potential open redirects if the extracted referrer value is later used to construct redirect targets, or other attacks that rely on bypassing origin checks. The fix involves anchoring the comparison more robustly, typically by checking for an exact match or ensuring the prefix is followed by a delimiter like /, as suggested in the advisory's proposed fix: ($referrer === $base || str_starts_with($referrer, $base . '/')).
Grav\Common\Uri::referrersystem/src/Grav/Common/Uri.php
Grav\Common\Page\Pages::referrerRoutesystem/src/Grav/Common/Page/Pages.php