Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback

Summary

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.

Remediation

1. Inventory every getgrav grav deployment, including staging.
2. Upgrade getgrav grav to 1.7.53.6.
3. Confirm the running version after the upgrade.

References

• Patchhttps://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641
• Advisoryhttps://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g
• Advisoryhttps://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback
• Referencehttps://github.com/getgrav/grav/releases/tag/1.7.53.6