IDOR vulnerability allowing to update another user's annotations in wallabag/wallabag
Valid
Reported on
Jan 22nd 2023
Description
IDOR vulnerability was discovered in wallabag.
Proof of Concept
- Login as a victim.
- Create an entry and an annotation. In this case the annotation's ID is 3.
- Login as an attacker.
- Send the following request.
request
PUT /annotations/3 HTTP/1.1
Host: localhost:8000
Cookie: PHPSESSID=e23e2dfc1b530c1884bf17248448b979
Content-Length: 21
{"id":3,"text":"xxx"}
- Victim's annotation created on step 2 is updated.
Impact
An attacker can update another user's annotations.
We are processing your report and will contact the
wallabag
team within 24 hours.
2 months ago
We have contacted a member of the
wallabag
team and are waiting to hear back
2 months ago
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
Changing CVSS score to 5.4 as there is a limited loss of confidentiality. Response from the call returns the annotated text
bAu
has been awarded the disclosure bounty
The fix bounty is now up for grabs
The researcher's credibility has increased: +7
Thank you!
The researcher's credibility has slightly increased as a result of the maintainer's thanks: +1
to join this conversation