Grav CMS Scheduler Webhook Authentication Bypass Leading to RCE

Vulnerability Overview Trilby Media / Grav CMS contains an authentication bypass vulnerability, specifically caused by an empty-short-circuit in the Webhook Token check. This vulnerability allows unauthorized remote attackers to execute all configured scheduled jobs on a default installation (where is not configured), potentially leading to remote code execution (RCE). Affected Versions Affected Versions: - - Fixed Versions: - - Remediation Upgrade to the following versions to remediate the vulnerability: Proof of Concept (PoC) Code Exploitation Steps 1. Verify webhook is enabled but no token is configured (default installation) - Send a GET request: - Check that and in the scheduler configuration. 2. Trigger all scheduled jobs without providing a token - Send a POST request: 3. If custom scheduled jobs run shell commands (a common use case for Grav Scheduler), the shell commands will execute with the privileges of the web server process, resulting in remote code execution. 4. Dynamic Testing (PHP Simulation Confirmation) - Send request: - Results: - - Outcome: Jobs executed (auth bypassed) - Status: [!!] BYPASSED - - Outcome: Invalid token - Status: [OK] Properly blocked - Confirmation: A null bypasses ALL authentication. Impact An unauthorized remote attacker can access the Grav CMS instance's scheduler webhook endpoint and execute all configured scheduled jobs on a default installation (where is not configured). By sending a single unauthenticated POST request to , if the scheduled jobs are configured to run shell commands (such as backups, log rotation, cache clearing, and system maintenance), each request will execute code with the privileges of the web server process, potentially leading to remote code execution. The vulnerability exists in the default administrative configuration (no token configured) rather than due to specific misconfiguration; therefore, every Grav deployment with the scheduler webhook enabled is susceptible. Grav operators who have set a token are not affected, nor are those who have completely disabled the webhook.

Goal Reached Thanks to every supporter — we hit 100%!

Grav CMS Scheduler Webhook Authentication Bypass Leading to RCE

More from this source