Security Advisories: GSA_kwCzR0hTQS1wOGdwLTg5OWMtanZxOc4AA1aY

Wallabag user can reset data unintentionally

Description

wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived.

This vulnerability has a CVSSv3.1 score of 4.3.

You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration.

Resolution

These actions are now doable only via POST method, which ensures that we can't do them via a 3rd-party website.

Credits

We would like to thank @zpbrent for reporting this issue through huntr.dev.

Reference: https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299/

Permalink: https://github.com/advisories/GHSA-p8gp-899c-jvq9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1wOGdwLTg5OWMtanZxOc4AA1aY
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 9 months ago
Updated: 9 months ago

CVSS Score: 5.7
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Identifiers: GHSA-p8gp-899c-jvq9, CVE-2023-4454
References:

• https://github.com/wallabag/wallabag/security/advisories/GHSA-p8gp-899c-jvq9
• https://github.com/wallabag/wallabag/commit/78b0b55c40511e1f22d5bbb4897aa10fca68441c
• https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299/
• https://github.com/advisories/GHSA-p8gp-899c-jvq9

Repository: https://github.com/wallabag/wallabag
Blast Radius: 4.0

Affected Packages