Description
Wiki.js through 2.5.314 fails to require path separators when matching START and END page rules, allowing attackers to access pages sharing a prefix with authorized folders. Users granted access to a folder can read and modify unrelated pages with matching prefixes, bypassing intended access controls.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
requarks Wiki.js
Default version status: unaffected
0 to ≤ 2.5.314affected
References
- https://github.com/geo-chen/oss/blob/main/wiki.md#finding-3-page-permission-rule-engine-grants-readwrite-access-to-any-page-whose-path-shares-a-literal-prefix-with-an-allowed-path-no-path-segment-boundary-check ↗
- https://github.com/requarks/wiki/blob/v2.5.314/server/core/auth.js#L252-L263 ↗
- https://github.com/requarks/wiki ↗
- https://www.vulncheck.com/advisories/wiki-js-through-2.5.314-path-prefix-matching-authorization-bypass ↗