CyberRota Analysis
AI-GeneratedThe Grav API plugin versions prior to 1.0.13 are vulnerable due to inadequate enforcement of API key scope restrictions, enabling attackers with a scoped api.config.write key to inject arbitrary commands into the scheduler's custom jobs. This flaw allows for remote code execution, posing a critical risk to the integrity and security of affected systems. Organizations utilizing this plugin should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Grav API plugin versions before 1.0.13 fail to enforce API key scope caps in ConfigController super-scope gates, allowing scoped keys to write scheduler configuration. The scope cap is applied only inside requirePermission(), while the scheduler and backups gates use a bare isSuperAdmin() check that never consults api_key_scopes. An attacker holding an API key scoped to api.config.write that was minted on a super account can therefore inject arbitrary commands into scheduler.custom_jobs, which Job::run() passes to a Symfony Process, achieving operating system command execution as the web server user.