Unauthenticated SSRF in YesWiki via Render Handler

Executive Summary

YesWiki before version 4.7.0 has an unauthenticated server-side request forgery (SSRF) vulnerability. Attackers can use wiki syntax [[|URL]] in the content parameter of the page render handler to make the server fetch arbitrary URLs. This allows access to internal hosts and ports, potentially reading their responses without authentication.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual requests originating from your YesWiki server, particularly those targeting internal hosts or ports. Check logs for attempts to access URLs via the [[|URL]] syntax in the render handler or content parameter. Use tools like tcpdump or Wireshark to capture outbound HTTP(S) requests from the server.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers to access internal systems and services that the YesWiki server can reach. They may read sensitive data from internal hosts, ports, or loopback addresses. The impact includes potential data breaches, unauthorized access to internal applications, and network reconnaissance.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. Organizations may face compliance violations if internal systems containing personal or health data are exposed due to this flaw.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade YesWiki to version 4.7.0 or later to patch the vulnerability. If upgrading is not possible, restrict access to the render handler endpoint and block outbound requests to internal networks. Disable the [[|URL]] raw-inclusion syntax if unused. Monitor for suspicious activity and apply network-level protections.

Useful 0 Not Useful 0