Grav Form Plugin Cross-Page Form Parsing Access Control Bypass (GHSA-33m4-m988-5vh)

Key Vulnerability Information Summary Vulnerability Overview Title: Cross-page form parsing allows anonymous visitors to execute form actions of restricted pages ID: GHSA-33m4-m988-5vh Severity: Moderate, CVSS v3 base score 6.9/10 Root Cause: When a POST cannot resolve to a form on the current page, falls back to , which scans the site's form registry and loads the form matching the POST's . If that form is defined on a login-restricted or unpublished page, anonymous visitors can trigger its actions (e.g., , , , ) by POSTing to any public page, thereby bypassing page access control. Scope of Impact Affected Package: Affected Versions: <= 9.1.21 Fixed Version: 9.1.22 Impact: Anonymous execution of actions for forms on restricted/unpublished pages, including: - : Writes attacker-controllable data to - : Sends emails - : Writes files to the restricted page's directory; can bypass the extension whitelist - : Invokes actions defined by the site - Two secondary sinks ( , ) are unreachable due to session restrictions, posing no account takeover risk Fix Fixed in : The cross-page fallback now verifies that the page owning the form is published and accessible to the current user, and deletes the 2FA session; all other visitors are rejected. Forms posting to their own page and forms with explicit routes are not affected. POC Code ``` Scenario: Page /members is restricted to logged-in users; its form's save action writes to user/data/ Anonymous GET /members returns a login wall, confirming ACLs are enforced at render time Control Group A — Anonymous is rejected (CSRF interception) POST / __form-name=nonexistent-form-nonce-000...&data[nonce]=x → no save POST / __form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent-form-name=nonexistent

Goal Reached Thanks to every supporter — we hit 100%!

Grav Form Plugin Cross-Page Form Parsing Access Control Bypass (GHSA-33m4-m988-5vh)

More from this source