Wallabag user can reset data unintentionally

CVE-2023-4454 → View on GitHub ↗ View on CVE.org ↗ View on NVD ↗

Description

Description

wallabag was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily reset annotations, entries and tags, by the GET request to /reset/annotations, /reset/entries, /reset/tags, /reset/archived.

This vulnerability has a CVSSv3.1 score of 4.3.

You should immediately patch your instance to version 2.6.3 or higher if you have more than one user and/or having open registration.

Resolution

These actions are now doable only via POST method, which ensures that we can't do them via a 3rd-party website.

Credits

We would like to thank @zpbrent for reporting this issue through huntr.dev.

Reference: https://huntr.dev/bounties/4ee0ef74-e4d4-46e7-a05c-076bce522299/

Basic information

Type
reviewed
Severity
medium
Advisory on GitHub
Open advisory ↗
Repository advisory
Open repository advisory ↗
Source code
Browse source ↗
Published (advisory)
2023-08-21 20:28:06 UTC
Updated
2023-08-24 21:48:13 UTC
GitHub reviewed
2023-08-21 20:28:06 UTC

EPSS Score

Score Percentile
0.11% 30.09%

CVSS Scores

Base score Version Severity Vector
5.7 3.1 —
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:R)
A real person has to do something—click, install, enable—otherwise it doesn’t land.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.

Identifiers

Type Value
GHSA GHSA-p8gp-899c-jvq9 ↗
CVE CVE-2023-4454 ↗

CWEs

CWE id Name
CWE-352 Cross-Site Request Forgery (CSRF)

Affected packages (1)

Vulnerable version ranges and first patched releases as published by GitHub.

Ecosystem Package Vulnerable range First patched Vulnerable functions
composer wallabag/wallabag >= 2.0.0-alpha.1, <= 2.6.2 2.6.3 —

References

cvelogic Threat Intelligence