Missing Authorization in YesWiki Pages Enumeration

Executive Summary

YesWiki before version 4.6.7 has a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool. This allows unauthenticated or unprivileged attackers to enumerate pages without proper read-ACL filtering by embedding these actions with a chosen tag or page name. The vulnerability exposes the names and body-derived titles of pages that should be restricted by Access Control Lists (ACL).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your YesWiki instance is running a version before 4.6.7. You can use commands like 'curl -s http://your-wiki-url/ | grep -i yeswiki' to identify the version. Additionally, test if the listpagestag and includepages actions are accessible without authentication by appending '{{listpagestag tag=test}}' or '{{includepages page=test}}' to a wiki page and observing if restricted page names or titles are exposed.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use this vulnerability to discover the names and titles of sensitive pages that are supposed to be restricted. This could help them plan further attacks by identifying targets or gathering sensitive metadata. While the default template does not leak full page content, the exposed metadata could still be valuable for targeted exploits.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing sensitive page metadata such as titles of ACL-restricted pages. Unauthorized disclosure of such information may violate data protection requirements under these regulations, particularly if the exposed data includes personally identifiable information or protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later to address the missing authorization checks. If upgrading is not immediately possible, restrict access to the tags tool actions by modifying server configurations or using web application firewalls to block unauthorized requests to listpagestag and includepages endpoints.

Useful 0 Not Useful 0