GHSA-23m2-mghx-vqmf: XSS
Impact
A reflected cross-site scripting (XSS) vulnerability exists on the dynamic image URL generator view within the Wagtail admin interface. A user with a limited-permission editor account for the Wagtail admin could craft a URL that, when viewed by a user with higher privileges, could perform actions with that user's credentials. The vulnerability is present for all sites, even if they do not enable the dynamic image serve view. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.3.3 and 7.4.2.
Workarounds
For sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to urls.py URL pattern declarations to override the vulnerable view. This disables the admin dynamic image preview functionality, while the public-facing dynamic image serve view still works.
python from django.http import HttpResponseBadRequest from django.urls import path from wagtail.admin import urls as wagtailadminurls
def disabledoutput(request, imageid): return HttpResponseBadRequest("", contenttype="text/plain")
urlpatterns = [ # Example where the CMS admin is at /admin/. # Add this before the Wagtail admin URLs registration, with the same sub-path. path("admin/images/<int:imageid>/generateurl/output/", disabledoutput), path("admin/", include(wagtailadminurls)), ]
Acknowledgements
Many thanks to Thibaud Colas (@thibaudcolas) for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels - Email us at security@wagtail.org (view our security policy for more information).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.2 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.3 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.3.3 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.4.2 - Configuration
To patch without upgrading, add an override URL pattern to your `urls.py` to replace the vulnerable dynamic image URL generator output view: define `disabled_output(request, image_id)` that returns `HttpResponseBadRequest("", content_type="text/plain")`, and add `path("admin/images/<int:image_id>/generate_url/output/", disabled_output)` to the `urlpatterns` list (and ensure the Wagtail admin URL registration is included with the same sub-path, e.g., `/admin/`).
Wagtail admin urls.py (URL pattern declarations) admin/images/<int:image_id>/generate_url/output/ view override = disabled_output (returns HttpResponseBadRequest)
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs access to the Wagtail admin through a limited-permission editor account. An ordinary site visitor without Wagtail admin access cannot exploit it.
What user interaction is required for impact?
The attacker must craft a malicious URL and have a higher-privileged Wagtail admin user view it. The resulting XSS can perform actions using that higher-privileged user's credentials.
Are sites affected if they have not enabled the dynamic image serve view?
Yes. The vulnerability is present on all sites, including those that have not enabled the dynamic image serve view.
What can be done if upgrading is not immediately possible?
Override the vulnerable admin view in the site's urls.py with the provided workaround. This disables admin dynamic image previews while leaving the public-facing dynamic image serve view operational.
Which Wagtail releases contain patches?
Patched releases are Wagtail 7.3.3 and 7.4.2.