CyberRota Analysis
AI-GeneratedGrav CMS versions prior to 2.0.16 are vulnerable to an origin validation bypass due to improper handling of the Referer header in the Uri::referrer() and Pages::referrerRoute() methods. This flaw allows attackers controlling a malicious domain that mimics the victim site's origin to bypass security checks, potentially leading to unauthorized access or data exposure. Organizations using Grav CMS should prioritize patching to mitigate this vulnerability and protect their applications from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav CMS before 2.0.16 contains an origin validation bypass in the Uri::referrer() and Pages::referrerRoute() methods, which validate the Referer header using an unanchored string prefix match (str_starts_with($referrer, $base)) with no trailing delimiter. An attacker who controls a domain that begins with the victim site's origin (e.g. https://example.com.attacker.tld) can send a request with such a Referer to be treated as same-origin, bypassing the Referer-based origin check.