GHSA-2f86-9cp8-6hcf Grav: Admin Backup Zip File Exposes Account Credentials and Configuration Secrets
SummaryAn authenticated administrator with backup permissions can download a ZIP archive containing the full Grav installation root, including `user/accounts/admin.yaml` with the admin's bcrypt password hash and email, plus `user/config/` with all site configuration. The download endpoint requires only the session-static `admin-nonce` in the URL, no additional form-level CSRF token, and reveals the server's full filesystem path in a Base64-encoded query parameter. Combined with the absence of login rate limiting on `http://{Grav_URL}/admin`, an attacker who obtains a single admin-nonce value (via Referrer leakage, browser history, or XSS) can exfiltrate password hashes for offline cracking and achieve account takeover.DetailsThe vulnerability chain spans three components in the deployed Grav source tree at `/var/www/html/grav/`:**1. Backup archive scope — `Backups::backup()`**  
`/var/www/html/grav/system/src/Grav/Common/Backup/Backups.php:201-272`The `backup()` static method creates a ZIP of the directory specified by the backup profile's `root` property. The default profile (ID `0`, named `default_site_backup`) backs up the entire Grav root directory. On line 225, when the root is not a stream URI, it falls back to the full installation path:Since the default profile ships with no `root` override, `$backup->root` is empty, making `$backup_root` equal to `GRAV_ROOT` — i.e. `/var/www/html/grav/`. The archive therefore captures the entire installation including:`/var/www/html/grav/user/accounts/` — admin password hash, email, full name, granular permissions`/var/www/html/grav/user/config/` — system settings, potentially email SMTP credentialsThe `exclude_files` and `exclude_paths` options on lines 232-235 are empty by default and offer no protection against including account files.**2. Backup download handler — `AdminController::taskBackup()`**  
`/var/www/html/grav/user/plugins/admin/classes/plugin/AdminController.php:517-573`After creating the backup ZIP, the controller Base64-encodes the full filesystem path and embeds it directly in a download URL displayed to the admin:The download handler (lines 532-541) decodes the path, locates the file via the `backup://` stream, and serves it with `Utils::download($file, true)`. It performs only two checks: the filename must end in `.zip` and the file must actually exist. It does **not** verify the file belongs to the requesting user, does **not** enforce a form-level nonce, and does **not** tie the download to a specific session.**3. Nonce validation — permissive**  
The backup route is protected only by the `admin-nonce` parameter appended to the URL path. This nonce is session-static and shared across every admin page. No `form-nonce` is required — unlike page saves or configuration changes which demand both `admin-nonce` and `form-nonce`. This makes the backup download exploitable via a single crafted GET request from any attacker who knows the nonce value.PoC**Prerequisites:** Admin session with valid `admin-nonce`.**Step 1 — Authenticate and extract the session-static nonces:****Step 2 — Trigger a backup (single GET, no form-nonce needed):**Response:**Step 3 — Extract the Base64 download token and fetch the ZIP:****Step 4 — Extract the password hash from the ZIP:**Output:**Step 5 — Crack the bcrypt hash offline:****Step 6 — Log in with the cracked password (no rate limit):**Impact**Type:** Authenticated sensitive data exposure enabling offline credential theft**Attack surface:** Any actor who can obtain admin-nonce (session fixation, reflected XSS, Referrer header leakage, browser history inspection, or proxy log access)**Exposed data:** Admin username, email, full name, granular permission structure, bcrypt password hash (`$2y$12$...`), and full site configuration from `user/config/`**Downstream risk:** Offline hashcat cracking bypasses all server-side brute-force protections. With no login rate limiting (Finding 1), a cracked hash grants immediate unrestricted admin access including file modification and arbitrary code execution potential through Twig/themes**Server path leakage:** The Base64-encoded download token reveals the absolute filesystem path `/var/www/html/grav/backup/` — information critical for LFI, file-write, and path traversal attacks
CVSS v3.1 score: 6.8