Information Exposure in Vikunja via Logged Share Hashes

Executive Summary

Vikunja before version 2.7.1 has an information exposure vulnerability where the raw URI of the /shares/:share/auth route, including link-share hashes, is logged. Attackers with access to logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write, or admin permissions.

Useful 0 Not Useful 0

Detection Guidance

Check Vikunja and reverse proxy access logs for entries containing '/shares/:share/auth' followed by a hash value. Use commands like 'grep -r "/shares/" /var/log/' to search for exposed hashes in logs.

Useful 0 Not Useful 0

Impact Analysis

If you use Vikunja versions 2.7.0 or earlier, attackers with access to your HTTP access logs or reverse proxy logs could extract share hashes and gain unauthorized access to your projects. This could lead to data theft, unauthorized modifications, or administrative control over shared projects.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Exposure of personal or health information in logs may result in non-compliance, potential fines, and reputational damage due to insufficient protection of sensitive data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Vikunja to version 2.7.1 or later to fix the logging issue. Review and sanitize existing logs to remove any exposed share hashes. Ensure all shares are password-protected if possible.

Useful 0 Not Useful 0