CVE-2023-0609: Wallabag/wallabag Wallabag Contains Improper Authorization Vulnerability

MODERATE
Advisory Identifier: GHSA-qwx8-mxxx-mg96
Share
CVSS 6.5
CWE-285
Published
Advisory Summary

CVE-2023-0609 is a MODERATE (CVSS 6.5) wallabag contains improper authorization vulnerability (CWE-285: Improper Authorization) affecting Wallabag/wallabag libraries in the Packagist ecosystem. The issue involves wallabag contains improper authorization via export feature. Remediation is available by upgrading affected packages to version 2.5.3.

CVE-2023-0609 at a Glance

CVE Identifier CVE-2023-0609
GHSA Identifier GHSA-qwx8-mxxx-mg96
Severity MODERATE
CVSS v3.1 Base Score 6.5
CWE Classification CWE-285: Improper Authorization
Affected Product Wallabag/wallabag
Package Ecosystem Packagist
Published Date
Last Updated

Security Impact

CVSS: 6.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity None (I:N)
Availability None (A:N)

How to Fix CVE-2023-0609

To remediate this vulnerability, upgrade all affected Wallabag/wallabag dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

wallabag/wallabag fixed: 2.5.3 
Upgrade wallabag/wallabag to 2.5.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for wallabag/wallabag

How to Check if You Are Affected

To determine whether your application is affected by CVE-2023-0609, inspect your project dependencies for Wallabag/wallabag:

inspect dependencies for wallabag/wallabag

Analyze the terminal output to locate any version of Wallabag/wallabag in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.5.3), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-285: Improper Authorization, where the product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. In Wallabag/wallabag, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

# Description The export feature lets a user export a single entry or a set of entries in a given format (_e.g. PDF, MOBI, TXT_). For example, `https://yourinstance.wallabag.org/export/45.pdf` will export the entry with id 45 in PDF format. Since wallabag 2.0.0-alpha.1, this feature is vulnerable to an insecure direct object reference attack. A logged user can export any single entry without ownership validation. This is due to a lack of access validation in the `downloadEntryAction` method. **You should immediately patch your instance to version 2.5.3 or higher if you have more than one user and/or having open registration.** # Resolution A user check is now done in the vulnerable method before sending the exported entry. The `Entry` retrieval through a `ParamConverter` has also been replaced with a call to the `EntryRepository` in order to prevent any information disclosure through response discrepancy. # Workaround If you are unable to update to the latest version or if you want to temporarily limit risk of exploitation, you may consider blocking requests to the endpoint `/export/*`. E.g. with nginx: ``` nginx location /export { deny all; } ``` # Credits We would like to thank @bAuh0lz for reporting this issue through huntr.dev. Reference: https://www.huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0/

CVE-2023-0609 Affected Wallabag/wallabag Versions

1 component(s)
Fixed Versions:
2.5.3
Product / Package Ecosystem Affected Versions Fixed Version
wallabag/wallabag
 Packagist
≥ 2.0.0-alpha.1
< 2.5.3
2.5.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/wallabag/wallabag/security/advisories/GHSA-qwx8-mxxx-mg96
NVD — CVE-2023-0609 NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-0609
Security Fix Commit FIX COMMIT
https://github.com/wallabag/wallabag/commit/0f7460dbab9e29f4f7d2944aca20210f828b6abb
Wallabag/wallabag Source Repository REPOSITORY
https://github.com/wallabag/wallabag
huntr.dev/bounties/3adef66f-f... WEB
https://huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0

Frequently Asked Questions

What is CVE-2023-0609?
CVE-2023-0609 is a security vulnerability in Wallabag/wallabag involving wallabag contains Improper Authorization via export feature under CWE-285: Improper Authorization.
Which Wallabag/wallabag versions are affected?
Affected versions include releases prior to 2.5.3 across affected packages: wallabag/wallabag.
What version fixes CVE-2023-0609?
Upgrading to 2.5.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is wallabag/wallabag affected?
Yes, wallabag/wallabag is affected in releases prior to 2.5.3. Upgrade your dependency to 2.5.3 or later.
What is the CVSS score of CVE-2023-0609?
CVE-2023-0609 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
What CWE is associated with CVE-2023-0609?
CVE-2023-0609 is classified under CWE-285: Improper Authorization (The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.).
How can I check Packagist dependencies for CVE-2023-0609?
Run the dependency tree command: 'inspect dependencies for wallabag/wallabag'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qwx8-mxxx-mg96",
  "modified" : "2023-02-02T19:27:29Z",
  "published" : "2023-02-02T19:26:44Z",
  "aliases" : [ "CVE-2023-0609" ],
  "summary" : "wallabag contains Improper Authorization via export feature",
  "details" : "# Description\n\nThe export feature lets a user export a single entry or a set of entries in a given format (_e.g. PDF, MOBI, TXT_).\n\nFor example, `https://yourinstance.wallabag.org/export/45.pdf` will export the entry with id 45 in PDF format.\n\nSince wallabag 2.0.0-alpha.1, this feature is vulnerable to an insecure direct object reference attack. A logged user can export any single entry without ownership validation.\n\nThis is due to a lack of access validation in the `downloadEntryAction` method.\n\n**You should immediately patch your instance to version 2.5.3 or higher if you have more than one user and/or having open registration.**\n\n# Resolution\n\nA user check is now done in the vulnerable method before sending the exported entry.\n\nThe `Entry` retrieval through a `ParamConverter` has also been replaced with a call to the `EntryRepository` in order to prevent any information disclosure through response discrepancy.\n\n# Workaround\n\nIf you are unable to update to the latest version or if you want to temporarily limit risk of exploitation, you may consider blocking requests to the endpoint `/export/*`.\n\nE.g. with nginx:\n\n``` nginx\n    location /export {\n        deny all;\n    }\n```\n\n# Credits\n\nWe would like to thank @bAuh0lz for reporting this issue through huntr.dev.\n\nReference: https://www.huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0/ ",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "wallabag/wallabag"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "2.0.0-alpha.1"
      }, {
        "fixed" : "2.5.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/wallabag/wallabag/security/advisories/GHSA-qwx8-mxxx-mg96"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-0609"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/wallabag/wallabag/commit/0f7460dbab9e29f4f7d2944aca20210f828b6abb"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/wallabag/wallabag"
  }, {
    "type" : "WEB",
    "url" : "https://huntr.dev/bounties/3adef66f-fc86-4e6d-a540-2ffa59342ff0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-285" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-02-02T19:26:44Z",
    "nvd_published_at" : null
  }
}