Description
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| getgrav | grav | 1.7.53.3 – < 1.7.53.6 | 1.7.53.6 |
References
- GitHub Security Advisory (GHSA-xprx-c7jf-cp6g) vendor-advisory
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641 patch
- grav 1.7.53.6 Release Notes release-notes
- VulnCheck Advisory: Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback third-party-advisory