Wallabag user can reset data unintentionally
Moderate severity
GitHub Reviewed
Published
Aug 21, 2023
in
wallabag/wallabag
•
Updated Aug 24, 2023
Package
Affected versions
>= 2.0.0-alpha.1, <= 2.6.2
Patched versions
2.6.3
Description
Published to the GitHub Advisory Database
Aug 21, 2023
Reviewed
Aug 21, 2023
Last updated
Aug 24, 2023
Description
wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to
/reset/annotations
,/reset/entries
,/reset/tags
,/reset/archived
.This vulnerability has a CVSSv3.1 score of 4.3.
You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration.
Resolution
These actions are now doable only via POST method, which ensures that we can't do them via a 3rd-party website.
Credits
We would like to thank @zpbrent for reporting this issue through huntr.dev.
Reference: https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299/
References