Cross-Site Request Forgery in YesWiki Filemanager

Executive Summary

YesWiki before version 4.6.7 has a cross-site request forgery (CSRF) vulnerability in the filemanager page handler. This flaw allows attackers to delete or permanently purge page attachments by tricking a logged-in owner or administrator into clicking a malicious link that triggers a GET request with commands like do=del, erase, or emptytrash. The application does not validate CSRF tokens for these actions, enabling unauthorized deletion of attachments.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your YesWiki instance is running a version before 4.6.7. You can verify the version by inspecting the footer or configuration files. Additionally, monitor network traffic for suspicious GET requests targeting the filemanager handler with parameters like do=del, erase, or emptytrash.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could lead to the loss of important page attachments, including documents, images, or other uploaded files. Attackers can permanently delete or purge these files by luring a logged-in user into visiting a malicious link. The impact is limited to the target page's upload directory due to prior path-traversal fixes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling unauthorized deletion of attachments, which may include sensitive data. GDPR requires data integrity and security, while HIPAA mandates protection of health information. Unauthorized deletions could violate these requirements if they involve protected data.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade YesWiki to version 4.6.7 or later. If upgrading is not possible, implement a web application firewall to block malicious GET requests targeting the filemanager handler. Ensure all sensitive actions require POST requests and CSRF token validation.

Useful 0 Not Useful 0