Description
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
getgrav grav
Default version status: unaffected
1.7.53.3 to < 1.7.53.6affected1.7.53.6unaffected
pkg:composer/getgrav/gravReferences
- https://github.com/getgrav/grav/security/advisories/GHSA-xprx-c7jf-cp6g ↗
- https://github.com/getgrav/grav/commit/4d9fca043f990a818d65cea61c928203b9e19641 ↗
- https://github.com/getgrav/grav/releases/tag/1.7.53.6 ↗
- https://www.vulncheck.com/advisories/grav-from-1.7.53.3-before-1.7.53.6-clockwork-profiler-authorization-bypass-via-loopback-fallback ↗