CVE-2024-34082

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the web server by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. A low privileged user may also perform a full account takeover of other registered users including Administrators. Version 1.7.46 contains a patch.

CVSS v3 8.5 HIGH

8.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.1 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://github.com/getgrav/grav/commit/b6bba9eb99bf8cb55b8fa8d23f18873ca594e348
https://github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69

Configurations

No configuration.

History

No history.

Information

Published : 2024-05-15 17:15

Updated : 2024-05-15 18:35

NVD link : CVE-2024-34082

Mitre link : CVE-2024-34082

CVE.ORG link : CVE-2024-34082

JSON object : View

Products Affected

No product.

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2024-34082", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 3.1}]}, "published": "2024-05-15T17:15:12.703", "references": [{"url": "https://github.com/getgrav/grav/commit/b6bba9eb99bf8cb55b8fa8d23f18873ca594e348", "source": "security-advisories@github.com"}, {"url": "https://github.com/getgrav/grav/security/advisories/GHSA-f8v5-jmfh-pr69", "source": "security-advisories@github.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - `/grav/user/accounts/*.yaml`. This file stores hashed user password, 2FA secret, and the password reset token. This can allow an adversary to compromise any registered account and read any file in the web server by resetting a password for a user to get access to the password reset token from the file or by cracking the hashed password. A low privileged user may also perform a full account takeover of other registered users including Administrators. Version 1.7.46 contains a patch."}, {"lang": "es", "value": "Grav es una plataforma web basada en archivos. Antes de la versi\u00f3n 1.7.46, una cuenta de usuario con privilegios bajos y privilegios de edici\u00f3n de p\u00e1gina pod\u00eda leer cualquier archivo del servidor usando Twig Syntax. Esto incluye archivos de cuentas de usuario de Grav: `/grav/user/accounts/*.yaml`. Este archivo almacena la contrase\u00f1a de usuario con hash, el secreto 2FA y el token de restablecimiento de contrase\u00f1a. Esto puede permitir que un adversario comprometa cualquier cuenta registrada y lea cualquier archivo en el servidor web restableciendo una contrase\u00f1a para que un usuario obtenga acceso al token de restablecimiento de contrase\u00f1a desde el archivo o descifrando la contrase\u00f1a hash. Un usuario con pocos privilegios tambi\u00e9n puede realizar una apropiaci\u00f3n completa de la cuenta de otros usuarios registrados, incluidos los administradores. La versi\u00f3n 1.7.46 contiene un parche."}], "lastModified": "2024-05-15T18:35:11.453", "sourceIdentifier": "security-advisories@github.com"}