Grav from 1.7.53.3 before 1.7.53.6 Clockwork Profiler Authorization Bypass via Loopback Fallback
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.7.53.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Grav content management system (versions before 1.7.53.6 in the 1.7.53 line) has a flaw in its Clockwork debugging profiler that lets unauthenticated visitors read stored debug data, which can include administrator passwords and configuration credentials. Under a reverse proxy on the same host, outside requests can be treated as local, which allows the access check to be bypassed.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that allows unauthenticated visitors to read /__clockwork/ profiler data via a loopback REMOTE_ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting attackers read stored records including administrator plaintext passwords and configuration credentials.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- getgrav grav
From 1.7.53.3 · fixed in 1.7.53.6