Outline Authorization Flaw in Outline Wiki Prior to 1.12.0

Executive Summary

Outline before 1.12.0 has an authorization flaw in authorizeDocumentPublish() that lets authenticated users publish documents to private collections even without write permissions. Attackers exploit this by unpublishing a child document, keeping its parentDocumentId, then using documents.update to inject content into a private collection for phishing.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Outline instance is running a version before 1.12.0. Use commands like 'docker inspect outline | grep Version' or 'curl -s https://your-outline-instance.com/ | grep version' to verify the version. If the version is below 1.12.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you use Outline before 1.12.0, attackers could inject malicious or phishing content into your private document collections. This could lead to data breaches, unauthorized access, or misinformation spread within your organization.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate GDPR by exposing private data to unauthorized users or HIPAA by allowing tampering with sensitive health records. Compliance may be impacted due to unauthorized access or data integrity issues.

Useful 0 Not Useful 0

Mitigation Strategies

Update Outline to version 1.12.0 or later to address the authorization flaw in authorizeDocumentPublish(). Review document permissions and private collection access controls to ensure only authorized users can publish content.

Useful 0 Not Useful 0