Unauthorized Page Data Exposure in Kirby CMS

Executive Summary

Kirby CMS versions prior to 4.9.4 and 5.4.4 have a vulnerability where authenticated users can access page information without proper authorization.

If a user role has the pages.access permission disabled, users who know or guess page IDs or UUIDs can retrieve full content and metadata of arbitrary published pages via the /api/site/find API route.

This happens because the API route does not enforce the pages.access permission, allowing unauthorized access to page data.

The issue was fixed by restricting the API to only return pages marked as listable, ensuring proper authorization checks.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized disclosure of sensitive information by allowing authenticated users to access full content and metadata of pages they should not have permission to view.

Although it does not allow modification or write actions, the exposure of confidential or private page data can compromise the security and privacy of the website.

The vulnerability requires only low privileges and no user interaction to exploit, increasing the risk of information leakage.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the /api/site/find route on a Kirby CMS installation with an authenticated user account that has the pages.access permission disabled. If the API returns full content and metadata for arbitrary published pages without proper authorization, the system is vulnerable.

A practical detection method is to use HTTP request tools such as curl or similar to query the API endpoint with known or guessed page IDs or UUIDs and observe if unauthorized page data is returned.

• curl -u <username>:<password> https://<kirby-site>/api/site/find?id=<page-id>
• Check if the response includes full page content and metadata for pages that the authenticated user should not have access to.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Kirby CMS to version 4.9.4 or 5.4.4 or later, where the vulnerability has been fixed by enforcing proper authorization checks on the /api/site/find route.

If upgrading immediately is not possible, restrict access to the /api/site/find API endpoint to trusted users only, or disable the API route temporarily to prevent unauthorized data disclosure.

Review and adjust user roles and permissions to ensure that users without the pages.access permission cannot authenticate or access sensitive API routes.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in Kirby CMS allows authenticated users to retrieve full content and metadata of arbitrary published pages without proper authorization. This unauthorized information disclosure could lead to exposure of sensitive or personal data.

Such exposure of sensitive information may negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict access controls and protection of personal and sensitive data.

By allowing unauthorized access to page content and metadata, the vulnerability increases the risk of data breaches and non-compliance with these standards.

Useful 0 Not Useful 0