Grav: Non constant time nonce comparison in Utils::verifyNonce() used for CSRF protection

Summary

Grav\Common\Utils::verifyNonce(), the core function Grav and its plugins use to validate CSRF nonces, compares the submitted nonce to the expected value with PHP's === operator instead of hash_equals(). === on strings short circuits at the first differing byte, so the comparison time leaks how many leading bytes of a guess are correct. This is CWE-208, Observable Timing Discrepancy.

The codebase already knows to avoid this pattern. hash_equals() is used for the equivalent purpose in four other places I found: system/src/Grav/Common/Session.php, system/src/Grav/Framework/Cache/Adapter/FileCache.php, system/src/Grav/Common/Scheduler/Scheduler.php (the webhook token check), and system/src/Grav/Common/Scheduler/JobQueue.php. Utils::verifyNonce() is the one place I found that still uses a plain equality check for a secret comparison.

Affected product and version

Product: Grav CMS, getgrav/grav Confirmed present in: 2.0.15, commit c2b46866857a93a0aa7048e7ed707ed3ed45dbc3

Affected code

system/src/Grav/Common/Utils.php, lines 1512 to 1521:

public static function verifyNonce($nonce, $action)
{
    //Safety check for multiple nonces
    if (is_array($nonce)) {
        $nonce = array_shift($nonce);
    }

    //Nonce generated 0-12 hours ago
    if ($nonce === self::getNonce($action)) {
        return true;
    }

    //Nonce generated 12-24 hours ago
    return $nonce === self::getNonce($action, true);
}

The nonce itself is md5($tick . '|' . $action . '|' . $username . '|' . session_id() . '|' . Security::getNonceKey()), computed in the private generateNonceString() a few lines above. Security::getNonceKey() is an installation level secret. So the value being compared with === is a value derived from a secret, which is exactly the case hash_equals() exists for.

Proof of concept, verified, real output

I could not exploit this end to end over a real network from this sandbox, since that requires a live deployment and a timing measurement setup outside a single machine. What I did verify directly, by running real code, is that the underlying primitive this function relies on, PHP's === string comparison, is not constant time in the PHP build actually used here, and that a measurable timing signal is still present at the exact length Grav's nonces have, 32 hex characters, an md5 digest.

Step 1, confirm PHP build:

$ php -v
PHP 8.3.6 (cli) (built: Jul 16 2026 18:30:41) (NTS)

Step 2, benchmark script, measures the median time of $a === $b over many trials, once with a long string to establish a clean signal, once at the real 32 byte nonce length:

<?php
// timing_poc2.php
function timeCompare(string $a, string $b, int $iterations): float {
    $r = null;
    $start = hrtime(true);
    for ($i = 0; $i < $iterations; $i++) {
        $r = ($a === $b);
    }
    $end = hrtime(true);
    return ($end - $start) / $iterations;
}

function median(array $arr): float {
    sort($arr);
    $n = count($arr);
    $mid = intdiv($n, 2);
    return $n % 2 ? $arr[$mid] : ($arr[$mid - 1] + $arr[$mid]) / 2;
}

function runExperiment(int $len, int $iterations, int $trials): array {
    $secret = bin2hex(random_bytes((int)ceil($len / 2)));
    $secret = substr($secret, 0, $len);

    $wrongEarly = $secret;
    $wrongEarly[0] = ($secret[0] === 'a') ? 'b' : 'a';

    $wrongLate = $secret;
    $last = $len - 1;
    $wrongLate[$last] = ($secret[$last] === 'a') ? 'b' : 'a';

    $earlyTimes = [];
    $lateTimes = [];
    timeCompare($wrongEarly, $secret, 20000);
    timeCompare($wrongLate, $secret, 20000);
    for ($t = 0; $t < $trials; $t++) {
        $earlyTimes[] = timeCompare($wrongEarly, $secret, $iterations);
        $lateTimes[]  = timeCompare($wrongLate, $secret, $iterations);
    }
    return [median($earlyTimes), median($lateTimes)];
}

echo "=== Length 4096 bytes, establishes the primitive is not constant time ===\n";
[$e, $l] = runExperiment(4096, 20000, 15);
printf("Median mismatch at position 0    : %.2f ns/op\n", $e);
printf("Median mismatch at last position : %.2f ns/op\n", $l);
printf("Ratio (late/early)               : %.2fx\n\n", $l / $e);

echo "=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===\n";
[$e2, $l2] = runExperiment(32, 200000, 21);
printf("Median mismatch at position 0    : %.2f ns/op\n", $e2);
printf("Median mismatch at last position : %.2f ns/op\n", $l2);
printf("Ratio (late/early)               : %.2fx\n", $l2 / $e2);

Step 3, run it three times to confirm the result is reproducible and not noise:

$ php timing_poc2.php

Actual output, run 1:

=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0    : 13.83 ns/op
Median mismatch at last position : 338.58 ns/op
Ratio (late/early)               : 24.48x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0    : 14.13 ns/op
Median mismatch at last position : 17.41 ns/op
Ratio (late/early)               : 1.23x

Actual output, run 2:

=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0    : 14.25 ns/op
Median mismatch at last position : 333.99 ns/op
Ratio (late/early)               : 23.44x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0    : 13.83 ns/op
Median mismatch at last position : 17.24 ns/op
Ratio (late/early)               : 1.25x

Actual output, run 3:

=== Length 4096 bytes, establishes the primitive is not constant time ===
Median mismatch at position 0    : 14.20 ns/op
Median mismatch at last position : 336.89 ns/op
Ratio (late/early)               : 23.73x

=== Length 32 bytes, the actual Grav nonce length, md5 hex output ===
Median mismatch at position 0    : 13.98 ns/op
Median mismatch at last position : 17.39 ns/op
Ratio (late/early)               : 1.24x

Interpretation, stated honestly. At 4096 bytes the effect is unambiguous and consistent across three independent runs, a mismatch near the end of the string takes about 23 to 24 times longer to reject than a mismatch at the very first byte, which is direct proof === is not constant time in this PHP build. At the real nonce length of 32 bytes the same direction of effect is present and reproducible across all three runs, roughly a 1.24x ratio, about 3 to 4 nanoseconds difference per comparison, but the signal is much smaller in absolute terms. I want to be direct about what this does and does not show. It proves the comparison used by verifyNonce() is not constant time and therefore not the right primitive for comparing secrets, which is why hash_equals() exists and is already used elsewhere in this codebase for the same category of check. It does not by itself prove a practical remote timing attack against a live Grav install, since a real attack would need to extract a nanosecond scale signal through normal HTTP round trip jitter, which is a much harder, though not unprecedented, condition and would need many repeated requests with statistical averaging per byte guessed. I did not attempt that network level attack since I do not have a live target instance.

Impact

verifyNonce() is Grav's documented core primitive for CSRF protection, used directly by core and referenced by the plugin ecosystem, including the Form plugin and Admin plugin, both outside this repository. Because the comparison is not constant time, an attacker in a position to send many requests and measure response timing with enough precision could in principle recover a valid nonce byte by byte rather than needing to guess the full 32 character value at once, weakening the CSRF protection below its intended security margin. The practical difficulty of pulling this off over a real network, given millisecond scale jitter against a nanosecond scale signal, is high, which is why I am reporting this as a hardening issue rather than claiming a demonstrated working exploit against a live site.

Suggested fix

Replace the two === comparisons in verifyNonce() with hash_equals(), matching the pattern already used in Session.php, FileCache.php, Scheduler.php, and JobQueue.php:

public static function verifyNonce($nonce, $action)
{
    if (is_array($nonce)) {
        $nonce = array_shift($nonce);
    }

    if (!is_string($nonce)) {
        return false;
    }

    if (hash_equals(self::getNonce($action), $nonce)) {
        return true;
    }

    return hash_equals(self::getNonce($action, true), $nonce);
}

hash_equals() also correctly requires the first argument to be a string, so the existing implicit array-to-string edge cases are worth double checking when you make this change.

=========================================================== CWE FIELD

CWE-208, Observable Timing Discrepancy

=========================================================== CVSS CALCULATOR SELECTIONS (v3.1)

Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

Resulting vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Resulting score: 5.3, severity Medium

Note for the maintainer: Attack Complexity is set to High because, as shown above, the measured timing signal at the real nonce length is small, on the order of a few nanoseconds, so reliable remote exploitation would require substantial statistical averaging and a favorable network position. If your own testing shows this is easier to exploit against a real deployment than my local measurement suggests, please rescore Attack Complexity to Low.

=========================================================== SEVERITY FIELD

Moderate