GHSA-2f75-93c9-xf32: Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images
Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Vikunja users who view rich-text content created or modified by someone with write access are exposed. The affected content can be stored in tasks, comments, project descriptions, or imported Markdown.
What must an attacker be able to do?
An attacker needs write access that lets them store rich-text content containing img elements. When another user opens that content, the viewer's client can be induced to make blind GET requests to loopback or LAN addresses.
Can this be used to identify when a user views content?
Yes. An attacker can use stored image requests to track when viewers open the planted content, in addition to causing requests to local services.
Which versions are affected?
Vikunja versions before 2.7.1 are affected.