Description

Grav from 2.0.22 before 2.1.7 contains an authentication bypass vulnerability in the Clockwork profiler that trusts loopback REMOTE_ADDR values. Unauthenticated attackers behind a same-host HTTP proxy can read profiler records exposing system and plugin configuration, secrets, request metadata, and queries.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-10-12T17:17:27.860Z",
  "pubdate": "2026-10-12T17:17:27.860Z",
  "executiveSummary": "Grav versions 2.0.22 through 2.1.6 are susceptible to an authentication bypass vulnerability within the Clockwork profiler component.\nThe vulnerability arises from an insecure trust mechanism that improperly validates the REMOTE_ADDR header, specifically when requests originate from a loopback address via a same-host HTTP proxy.\nThis flaw allows unauthenticated remote attackers to circumvent standard access controls and gain unauthorized access to the Clockwork profiler interface.\nSuccessful exploitation exposes highly sensitive system metadata, including internal plugin configurations, application secrets, detailed request traces, and database query logs.\nThe risk implication is critical, as the disclosed information can be leveraged to facilitate further exploitation of the Grav CMS instance, including privilege escalation or full system compromise.\nThe primary requirement for exploitation is the existence of a same-host HTTP proxy configuration that causes the application to perceive the incoming request as originating from a trusted local loopback address.",
  "technicalDetails": "The root cause of this vulnerability lies in the Clockwork profiler’s reliance on the REMOTE_ADDR server variable to enforce access control. In many production environments, web servers or HTTP proxies (such as Nginx or Apache) running on the same host as the application may forward requests to the PHP backend. When the environment is configured to trust loopback addresses, the Clockwork component incorrectly assumes that any request originating from 127.0.0.1 or ::1 is inherently authorized for administrative debugging access.\nThe Clockwork profiler is intended to be a developer tool providing deep visibility into application performance and state. By trusting the REMOTE_ADDR value without verifying the presence of authorized authentication tokens or secondary IP validation headers (like X-Forwarded-For when configured properly), the application creates a logic flaw. An attacker situated behind the same-host proxy can craft requests that appear to the application as local traffic, effectively bypassing the authentication middleware that normally protects the /clockwork endpoint.\nThe exploitation flow proceeds as follows: 1) The attacker targets an exposed HTTP service or proxy that routes requests to the Grav instance. 2) The attacker issues an HTTP request designed to access the Clockwork profiler URI. 3) The underlying system or proxy environment populates the REMOTE_ADDR as a loopback address during the request hand-off. 4) The Clockwork component evaluates the request, detects the loopback IP, and grants full access to the profiler dashboard.\nOnce access is achieved, the attacker can view the following: System and plugin configurations, which may contain hardcoded credentials or sensitive API keys; session data and request metadata containing user information; and verbose logs of SQL or NoSQL queries, which often reveal database structure or internal path information. Because this information is stored within the profiler's data collection, it can be dumped entirely by the attacker, leading to a comprehensive information disclosure event that significantly lowers the barrier for subsequent, more destructive attacks against the Grav CMS."
}