getgrav/grav-plugin-login: Page author can create a super user account through a Login invitation form

Summary

The Login plugin's invitation form task (login.invite) sent invitations without checking who submitted the form, and took the new account's access straight from the page's frontmatter with no limit. A user who could author a page could define an invitation form that grants super access, submit it without signing in, and register the invited address as a super user.

Affected versions

Login 3.6.0 through 3.9.12. The invitation feature was added in 3.6.0. The plugin runs on both Grav 1.7 and 2.x, and the fixed release covers both.

Details

Controller::taskInvite() required only that a form was active on the page. Any visitor who can load the page can submit its form, so this was not a check on the sender. The task then read form.meta.invite.account from the page and stored it in the invitation as the access for the new account, with no cap on what could be granted. An invitation sent by an anonymous visitor was recorded with no issuer.

Registration with a valid invitation token works when public registration is turned off, and it copies the invitation's account settings into the new user.

The Invitations API in the API plugin already required api.users.write and removed super access and groups for non-super senders. The page form task had neither control.

The original report presents the Pages API accepting a form block from a non-super author and the missing check in the Login plugin as equal parts of the issue. The missing check is the defect: any page carrying an invitation form could be submitted by anyone, and the grant was never capped.

Impact

An account limited to writing pages can obtain a separate account with super access, and with it full control of the site. No administrator has to take part. The attacker needs the invitation email to reach an address they control.

Patches

Fixed in Login 3.9.13. An invitation form can only be sent by a signed-in user who manages accounts (admin.users or api.users.write, or a super user), whatever the page's own access says. Only a super user can invite someone into super access or into groups; for anyone else those are removed from the invitation.

Sites whose invitation page was restricted with access: admin.login, as the README example previously showed, should note that the sender now needs an account management permission.

Credits

Reported by @ffasterss and @shirabe0x05 of Omoikane Labs.