Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getgrav/grav | composer | < 2.0.16 |
Miggo AIRoot Cause AnalysisThe vulnerability, GHSA-px9v-979x-qmh9 (a duplicate of GHSA-38p6-h87p-r4cg), describes a timing attack in Grav CMS's CSRF nonce validation. Specifically, the Grav\Common\Utils::verifyNonce function used the === operator for comparing nonces. This operator is not constant-time, meaning its execution time can vary based on the input strings, revealing information about the nonce through timing side channels. An attacker could exploit this by sending multiple requests and observing response times to deduce the correct nonce value byte by byte, thereby bypassing CSRF protection.
My analysis started by fetching the content of the primary advisory (GHSA-38p6-h87p-r4cg), which provided explicit details about the vulnerable function (Grav\Common\Utils::verifyNonce), its file path (system/src/Grav/Common/Utils.php), and the nature of the vulnerability (non-constant-time comparison using ===). It also indicated that the fix was introduced in version 2.0.16.
I then used get_repo_tags to find the commit SHA for version 2.0.16 (804731d7becab374a49dfb784435aa8cd6480547) and the last vulnerable version 2.0.15 (d5f89d95d94cc155bc3be998ee8527a7be073dd). By comparing these two commits using compare_two_commits, I identified a specific commit (a076b9073abc51c1df924529d65773e44950c5c4) with the message [security] Constant-time nonce comparison in Utils::verifyNonce() (GHSA-38p6-h87p-r4cg). This commit directly addresses the reported vulnerability.
Retrieving the commit information for this specific commit confirmed that the system/src/Grav/Common/Utils.php file was modified. The patch clearly shows the replacement of the === operator with hash_equals() within the verifyNonce function, along with an added is_string check for robustness. This change ensures that the nonce comparison is performed in constant time, preventing timing attacks.
Therefore, the Grav\Common\Utils::verifyNonce function, as it existed before the patch (i.e., in versions prior to 2.0.16), is the vulnerable function. Its presence in a runtime profile would indicate that the application is performing CSRF nonce validation using a non-constant-time comparison, making it susceptible to timing attacks.
Grav\Common\Utils::verifyNoncesystem/src/Grav/Common/Utils.php