CVE-2021-21425
CRITICALGrav Admin Plugin < 1.10.8 - Unauthenticated Arbitrary YAML Write via Administrator Controller
Title source: llmExploitation Summary
EIP tracks 7 public exploits for CVE-2021-21425.
PoCs published by Mehmet Ince, CsEnox, bluetoothStrawberry, including Metasploit module exploits/linux/http/gravcms_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary YAML write vulnerability in GravCMS Admin Plugin (CVE-2021-21425) to achieve remote code execution by manipulating the scheduler configuration to execute a PHP payload.
Description
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in arbitrary YAML file creation or content change of existing YAML files on the system. Successfully exploitation of that vulnerability results in configuration changes, such as general site information change, custom scheduler job definition, etc. Due to the nature of the vulnerability, an adversary can change some part of the webpage, or hijack an administrator account, or execute operating system command under the context of the web-server user. This vulnerability is fixed in version 1.10.8. Blocking access to the `/admin` path from untrusted sources can be applied as a workaround.
Exploits (7)
This Metasploit module exploits an unauthenticated arbitrary YAML write vulnerability in GravCMS Admin Plugin (CVE-2021-21425) to achieve remote code execution by manipulating the scheduler configuration to execute a PHP payload.
This repository contains a functional exploit for CVE-2021-21425, which targets GravCMS. The exploit leverages unauthenticated arbitrary YAML write/update to achieve remote code execution by scheduling a task to create and execute a shell script.
This repository contains a functional exploit for CVE-2021-21425, targeting GravCMS 1.10.7. The exploit leverages an unauthenticated arbitrary YAML write vulnerability to schedule a malicious cron job, resulting in remote code execution (RCE) via a PHP web shell.
This repository contains a functional exploit for CVE-2021-21425, an unauthenticated RCE vulnerability in GravCMS <= 1.10.7. The exploit abuses the scheduler configuration to create a malicious cron job that executes arbitrary PHP code, resulting in remote command execution.
This repository contains a functional exploit for CVE-2021-21425, an unauthenticated RCE vulnerability in GravCMS <= 1.10.7. The exploit abuses the scheduler configuration to create a malicious cron job that executes arbitrary PHP code.
This repository contains a functional exploit for CVE-2021-21425, targeting GravCMS 1.10.7. The exploit leverages an unauthenticated arbitrary YAML write/update vulnerability to achieve remote code execution (RCE) by scheduling a malicious PHP command via the admin tools.
This Metasploit module exploits an unauthenticated arbitrary YAML write vulnerability in GravCMS Admin Plugin (CVE-2021-21425) to achieve remote code execution by manipulating the scheduler configuration to execute a PHP payload.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:N