CVE-2025-66305: Getgrav/grav Denial of Service Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m8vh-v6r6-w7p6",
  "modified" : "2025-12-02T00:46:05Z",
  "published" : "2025-12-02T00:46:05Z",
  "aliases" : [ "CVE-2025-66305" ],
  "summary" : "Grav vulnerable to Denial of Service via Improper Input Handling in 'Supported' Parameter",
  "details" : "**Endpoint**: `admin/config/system`  \n**Submenu**: `Languages`  \n**Parameter**: `Supported`  \n**Application**: Grav v 1.7.48\n\n---\n\n## Summary\n\nA Denial of Service (DoS) vulnerability was identified in the **\"Languages\"** submenu of the Grav **admin configuration panel** (`/admin/config/system`). Specifically, the `Supported` parameter fails to properly validate user input. If a malformed value is inserted—such as a single forward slash (`/`) or an XSS test string—it causes a fatal regular expression parsing error on the server.\n\nThis leads to application-wide failure due to the use of the `preg_match()` function with an **improperly constructed regular expression**, resulting in the following error:\n\n`preg_match(): Unknown modifier 'o' File: /system/src/Grav/Common/Language/Language.php line 244`\n\nOnce triggered, the site becomes completely unavailable to all users.\n\n---\n\n## Details\n\n- **Vulnerable Endpoint**: `POST /admin/config/system`\n    \n- **Submenu**: `Languages`\n    \n- **Parameter**: `Supported`  \n    \n\nThe application dynamically constructs a regular expression using the contents of the `Supported` field without escaping the input using `preg_quote()` or proper validation. This allows attackers to inject invalid syntax into the regex engine, crashing the application during language resolution.\n\n**Stack trace excerpt**:\n\n`Whoops \\ Exception \\ ErrorException (E_WARNING) preg_match(): Unknown modifier 'o' /system/src/Grav/Common/Language/Language.php244`\n\n---\n\n## Proof of Concept (PoC)\n\n### Payloads:\n\n`/ `\n\n### Steps to Reproduce:\n\n1. Log into the Grav Admin Panel.\n    \n2. Navigate to: **Configuration** → **System** → **Languages**.\n    \n3. Locate the `Supported` field.\n    \n4. Insert one of the payloads above (e.g., a single slash `/`).\n    \n5. Click **Save**.\n\n<img width=\"1897\" height=\"639\" alt=\"Pasted image 20250719183223\" src=\"https://github.com/user-attachments/assets/d3a54a20-d30d-46c6-9015-722f80701cfb\" />\n\n1. Observe: All pages in the application begin throwing a fatal error and become inaccessible.\n\n<img width=\"1802\" height=\"998\" alt=\"Pasted image 20250719175229\" src=\"https://github.com/user-attachments/assets/b16750c2-507f-4c30-a9bb-d07fa92bb777\" />\n\n---\n\n## Impact\n\n- Application-wide Denial of Service (DoS)\n    \n- All login and admin views crash with the same error\n    \n- Potentially exploitable by:\n    \n    - Admin panel users\n        \n    - CSRF if misconfigured        \n    \n\n---\n\n## References\n\n- **CWE-1333**: Improper Regular Expression\n    \n- **CWE-20**: Improper Input Validation\n\n\n## Discoverer\n\n[Marcelo Queiroz](www.linkedin.com/in/marceloqueirozjr) \n\nby [CVE-Hunters](https://github.com/Sec-Dojo-Cyber-House/cve-hunters)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "getgrav/grav"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.8.0-beta.27"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/getgrav/grav/security/advisories/GHSA-m8vh-v6r6-w7p6"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-66305"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/getgrav/grav/commit/ed640a13143c4177af013cf001969ed2c5e197ee"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/getgrav/grav"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-248" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2025-12-02T00:46:05Z",
    "nvd_published_at" : "2025-12-01T22:15:50Z"
  }
}