Grav API Plugin Vulnerability: Potential Account Takeover Risk
An early warning has been issued regarding a critical vulnerability in the Grav API plugin (grav-plugin-api) versions before 1.0.4 and 1.0.8, which may allow unauthenticated attackers to perform account takeovers.
What happened
Reportedly, the Grav API plugin (grav-plugin-api) before version 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. This vulnerability allows an attacker to supply an arbitrary host, causing the password reset email to contain a link to an attacker-controlled server. When the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover.
Additionally, the Grav API plugin (grav-plugin-api) before version 1.0.8 appears to fail to properly authorize API key generation and revocation. This flaw allows any user with admin.login permission to mint a persistent API key bound to any account, potentially leading to account impersonation and privilege escalation up to account takeover.
Professional software engineers using the Grav API plugin are advised to upgrade to version 1.0.4 or later to mitigate these risks. Further details and confirmations should be obtained from the primary sources linked in the threat data.
How 0Day mitigates this
grav-plugin-api is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.