GHSA-269c-h76q-8cxwmedium5.4

Grav: Stored XSS via quoted-attribute bypass in detectXss

The advisory, in context

Summary

A page editor without admin.super can place an event handler after a > inside a quoted attribute. Grav accepts and stores the page, then executes the handler in the application origin when a visitor opens it.

Details

Security::detectXss() (system/src/Grav/Common/Security.php:253) anchors the on_events scan at < and uses [^>]*?, which cannot cross the first literal >. When that character is inside a quoted value, the browser keeps the tag open and parses the later onerror attribute, so the detector and browser disagree. AdminController::savePage() relies on this detector when saving content from page editors outside the admin.super whitelist.

PoC

I reproduced this with getgrav/grav 2.0.11 (ad9709f865b09b68798fb1ac375b484a8cc1d892), Admin 1.10.52, and Quark 2 1.1.4.

Sign in as a user with admin.login and admin.pages, but without admin.super.
Create or edit /xsstest and save this page body:

<img src=x title=">" onerror=alert(document.domain)>

Open /xsstest in a private browser window.

The save succeeds and the visitor sees an alert containing the site domain. With the body changed to <img src=x onerror=alert(1)>, the same endpoint rejects it with XSS issue detected and does not store it.

Impact

A page editor can execute JavaScript in the origin of every user who views the stored page, including unauthenticated visitors.

Anticipated objection and response

Although the detectXss() docblock describes it as a heuristic that cannot catch every XSS, this check is the storage-time boundary for page editors outside the default security.xss_whitelist of admin.super. The same endpoint rejects a plain handler but accepts this executable form, allowing a lower-trust editor to cross the boundary the check is intended to enforce.

Suggested fix

Prefer an HTML tokenizer or sanitizer that rejects event-handler attributes on parsed elements. If the existing tripwire remains, make its tag scan quote-aware instead of treating every > as a boundary. Add double-quoted and single-quoted regression cases plus the rejected plain-handler control.

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

getgrav/grav Packagist

Ecosystem versions

From 1.5.2 before 2.0.13

Fixed in 2.0.13

211 explicitly affected versions

1.5.10, 1.5.2, 1.5.3, 1.5.4, 1.5.5, 1.5.6, 1.5.7, 1.5.8, 1.5.9, 1.6.0, 1.6.0-beta.1, 1.6.0-beta.2, 1.6.0-beta.3, 1.6.0-beta.4, 1.6.0-beta.5, 1.6.0-beta.6, 1.6.0-beta.7, 1.6.0-beta.8, 1.6.0-rc.1, 1.6.0-rc.2, 1.6.0-rc.3, 1.6.0-rc.4, 1.6.1, 1.6.10, 1.6.11, 1.6.12, 1.6.13, 1.6.14, 1.6.15, 1.6.16, 1.6.17, 1.6.18, 1.6.19, 1.6.2, 1.6.20, 1.6.21, 1.6.22, 1.6.23, 1.6.24, 1.6.25, 1.6.26, 1.6.27, 1.6.28, 1.6.29, 1.6.3, 1.6.30, 1.6.31, 1.6.4, 1.6.5, 1.6.6, 1.6.7, 1.6.8, 1.6.9, 1.7.0, 1.7.0-beta.1, 1.7.0-beta.10, 1.7.0-beta.2, 1.7.0-beta.3, 1.7.0-beta.4, 1.7.0-beta.5, 1.7.0-beta.6, 1.7.0-beta.7, 1.7.0-beta.8, 1.7.0-beta.9, 1.7.0-rc.1, 1.7.0-rc.10, 1.7.0-rc.11, 1.7.0-rc.12, 1.7.0-rc.13, 1.7.0-rc.14, 1.7.0-rc.15, 1.7.0-rc.16, 1.7.0-rc.17, 1.7.0-rc.18, 1.7.0-rc.19, 1.7.0-rc.2, 1.7.0-rc.20, 1.7.0-rc.3, 1.7.0-rc.4, 1.7.0-rc.5, 1.7.0-rc.6, 1.7.0-rc.7, 1.7.0-rc.8, 1.7.0-rc.9, 1.7.1, 1.7.10, 1.7.12, 1.7.13, 1.7.14, 1.7.15, 1.7.16, 1.7.17, 1.7.18, 1.7.19, 1.7.20, 1.7.21, 1.7.22, 1.7.23, 1.7.24, 1.7.25, 1.7.26, 1.7.26.1, 1.7.27, 1.7.27.1, 1.7.28, 1.7.29, 1.7.29.1, 1.7.3, 1.7.30, 1.7.31, 1.7.32, 1.7.33, 1.7.34, 1.7.35, 1.7.36, 1.7.37, 1.7.37.1, 1.7.38, 1.7.39, 1.7.39.1, 1.7.39.2, 1.7.39.3, 1.7.39.4, 1.7.4, 1.7.40, 1.7.41, 1.7.41.1, 1.7.41.2, 1.7.42, 1.7.42.1, 1.7.42.2, 1.7.42.3, 1.7.43, 1.7.44, 1.7.45, 1.7.46, 1.7.47, 1.7.48, 1.7.49, 1.7.49.1, 1.7.49.2, 1.7.49.3, 1.7.49.4, 1.7.49.5, 1.7.5, 1.7.51, 1.7.52, 1.7.53, 1.7.53.1, 1.7.53.2, 1.7.53.3, 1.7.6, 1.7.7, 1.7.8, 1.7.9, 1.8.0-beta.1, 1.8.0-beta.10, 1.8.0-beta.11, 1.8.0-beta.12, 1.8.0-beta.13, 1.8.0-beta.14, 1.8.0-beta.15, 1.8.0-beta.16, 1.8.0-beta.17, 1.8.0-beta.18, 1.8.0-beta.19, 1.8.0-beta.2, 1.8.0-beta.20, 1.8.0-beta.21, 1.8.0-beta.22, 1.8.0-beta.23, 1.8.0-beta.24, 1.8.0-beta.25, 1.8.0-beta.26, 1.8.0-beta.27, 1.8.0-beta.28, 1.8.0-beta.29, 1.8.0-beta.3, 1.8.0-beta.4, 1.8.0-beta.5, 1.8.0-beta.6, 1.8.0-beta.7, 1.8.0-beta.8, 1.8.0-beta.9, 2.0.0, 2.0.0-beta.1, 2.0.0-beta.2, 2.0.0-beta.3, 2.0.0-beta.4, 2.0.0-rc.1, 2.0.0-rc.10, 2.0.0-rc.2, 2.0.0-rc.3, 2.0.0-rc.4, 2.0.0-rc.5, 2.0.0-rc.6, 2.0.0-rc.7, 2.0.0-rc.8, 2.0.0-rc.9, 2.0.1, 2.0.10, 2.0.11, 2.0.12, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.5.2"
        },
        {
          "fixed": "2.0.13"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "1.5.10",
    "1.5.2",
    "1.5.3",
    "1.5.4",
    "1.5.5",
    "1.5.6",
    "1.5.7",
    "1.5.8",
    "1.5.9",
    "1.6.0",
    "1.6.0-beta.1",
    "1.6.0-beta.2",
    "1.6.0-beta.3",
    "1.6.0-beta.4",
    "1.6.0-beta.5",
    "1.6.0-beta.6",
    "1.6.0-beta.7",
    "1.6.0-beta.8",
    "1.6.0-rc.1",
    "1.6.0-rc.2",
    "1.6.0-rc.3",
    "1.6.0-rc.4",
    "1.6.1",
    "1.6.10",
    "1.6.11",
    "1.6.12",
    "1.6.13",
    "1.6.14",
    "1.6.15",
    "1.6.16",
    "1.6.17",
    "1.6.18",
    "1.6.19",
    "1.6.2",
    "1.6.20",
    "1.6.21",
    "1.6.22",
    "1.6.23",
    "1.6.24",
    "1.6.25",
    "1.6.26",
    "1.6.27",
    "1.6.28",
    "1.6.29",
    "1.6.3",
    "1.6.30",
    "1.6.31",
    "1.6.4",
    "1.6.5",
    "1.6.6",
    "1.6.7",
    "1.6.8",
    "1.6.9",
    "1.7.0",
    "1.7.0-beta.1",
    "1.7.0-beta.10",
    "1.7.0-beta.2",
    "1.7.0-beta.3",
    "1.7.0-beta.4",
    "1.7.0-beta.5",
    "1.7.0-beta.6",
    "1.7.0-beta.7",
    "1.7.0-beta.8",
    "1.7.0-beta.9",
    "1.7.0-rc.1",
    "1.7.0-rc.10",
    "1.7.0-rc.11",
    "1.7.0-rc.12",
    "1.7.0-rc.13",
    "1.7.0-rc.14",
    "1.7.0-rc.15",
    "1.7.0-rc.16",
    "1.7.0-rc.17",
    "1.7.0-rc.18",
    "1.7.0-rc.19",
    "1.7.0-rc.2",
    "1.7.0-rc.20",
    "1.7.0-rc.3",
    "1.7.0-rc.4",
    "1.7.0-rc.5",
    "1.7.0-rc.6",
    "1.7.0-rc.7",
    "1.7.0-rc.8",
    "1.7.0-rc.9",
    "1.7.1",
    "1.7.10",
    "1.7.12",
    "1.7.13",
    "1.7.14",
    "1.7.15",
    "1.7.16",
    "1.7.17",
    "1.7.18",
    "1.7.19",
    "1.7.20",
    "1.7.21",
    "1.7.22",
    "1.7.23",
    "1.7.24",
    "1.7.25",
    "1.7.26",
    "1.7.26.1",
    "1.7.27",
    "1.7.27.1",
    "1.7.28",
    "1.7.29",
    "1.7.29.1",
    "1.7.3",
    "1.7.30",
    "1.7.31",
    "1.7.32",
    "1.7.33",
    "1.7.34",
    "1.7.35",
    "1.7.36",
    "1.7.37",
    "1.7.37.1",
    "1.7.38",
    "1.7.39",
    "1.7.39.1",
    "1.7.39.2",
    "1.7.39.3",
    "1.7.39.4",
    "1.7.4",
    "1.7.40",
    "1.7.41",
    "1.7.41.1",
    "1.7.41.2",
    "1.7.42",
    "1.7.42.1",
    "1.7.42.2",
    "1.7.42.3",
    "1.7.43",
    "1.7.44",
    "1.7.45",
    "1.7.46",
    "1.7.47",
    "1.7.48",
    "1.7.49",
    "1.7.49.1",
    "1.7.49.2",
    "1.7.49.3",
    "1.7.49.4",
    "1.7.49.5",
    "1.7.5",
    "1.7.51",
    "1.7.52",
    "1.7.53",
    "1.7.53.1",
    "1.7.53.2",
    "1.7.53.3",
    "1.7.6",
    "1.7.7",
    "1.7.8",
    "1.7.9",
    "1.8.0-beta.1",
    "1.8.0-beta.10",
    "1.8.0-beta.11",
    "1.8.0-beta.12",
    "1.8.0-beta.13",
    "1.8.0-beta.14",
    "1.8.0-beta.15",
    "1.8.0-beta.16",
    "1.8.0-beta.17",
    "1.8.0-beta.18",
    "1.8.0-beta.19",
    "1.8.0-beta.2",
    "1.8.0-beta.20",
    "1.8.0-beta.21",
    "1.8.0-beta.22",
    "1.8.0-beta.23",
    "1.8.0-beta.24",
    "1.8.0-beta.25",
    "1.8.0-beta.26",
    "1.8.0-beta.27",
    "1.8.0-beta.28",
    "1.8.0-beta.29",
    "1.8.0-beta.3",
    "1.8.0-beta.4",
    "1.8.0-beta.5",
    "1.8.0-beta.6",
    "1.8.0-beta.7",
    "1.8.0-beta.8",
    "1.8.0-beta.9",
    "2.0.0",
    "2.0.0-beta.1",
    "2.0.0-beta.2",
    "2.0.0-beta.3",
    "2.0.0-beta.4",
    "2.0.0-rc.1",
    "2.0.0-rc.10",
    "2.0.0-rc.2",
    "2.0.0-rc.3",
    "2.0.0-rc.4",
    "2.0.0-rc.5",
    "2.0.0-rc.6",
    "2.0.0-rc.7",
    "2.0.0-rc.8",
    "2.0.0-rc.9",
    "2.0.1",
    "2.0.10",
    "2.0.11",
    "2.0.12",
    "2.0.2",
    "2.0.3",
    "2.0.4",
    "2.0.5",
    "2.0.6",
    "2.0.7",
    "2.0.8",
    "2.0.9"
  ]
}

Set up in your agent.

Investigate in your agent.