Grav CMS versions 1.7.0 through 1.7.53.2 and 2.0.0 through 2.0.21 contain a vulnerability where the Clockwork profiler endpoint is exposed without authentication if the debugger is enabled (system.debugger.enabled: true). The InitializeProcessor::handleDebuggerRequest() method intercepts requests containing /__clockwork/ and forwards them to Debugger::debuggerRequest() without performing user authentication, IP restrictions, or Clockwork authenticator checks. This exposure allows anonymous users to paginate through the entire stored history, which includes sensitive data such as raw request cookies (including PHP session IDs), plaintext login passwords, and the full system and plugin configuration with operator secrets like SMTP credentials and API keys. Authorization and X-API-Token headers are also stored even when censoring is enabled. On Grav 2.0, forcing the debugbar provider does not mitigate the issue due to forced Clockwork usage for JSON requests. The vulnerability is addressed in versions 1.7.53.4 and 2.0.22 by restricting access to /__clockwork/ to local server requests or requests presenting a secret token, and by stripping cookies and credential headers from stored records. Workarounds include disabling the debugger or blocking the /__clockwork/ endpoint at the web server or CDN.

An attacker can access the Clockwork profiler endpoint without authentication, exposing sensitive information including session cookies that allow session hijacking, plaintext passwords submitted via login forms, and the entire system and plugin configuration containing secrets such as SMTP credentials and API keys. This exposure can lead to unauthorized access and compromise of the Grav CMS installation and potentially other integrated services.

A fix is available in Grav versions 1.7.53.4 and 2.0.22 that restricts access to the /__clockwork/ endpoint to server-local requests or requests presenting a secret token, and removes sensitive data from stored records. Users should upgrade to these fixed versions. Alternatively, disabling the debugger (setting system.debugger.enabled to false) or blocking access to the /__clockwork/ path at the web server or CDN level can mitigate the issue.