GHSA-3vrh-m9w7-v94f: Medium severity pip/wagtail vulnerability
Impact
The internal Pages admin API incorrectly returns page fields without access control when they are declared in apifields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of apifields on the base page model (title, slug, seotitle, searchdescription), as well as all custom fields declared in apifields.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds
Site owners unable to upgrade can apply the fix by overriding the relevant method on PagesAdminAPIViewSet to patch all vulnerable admin API endpoints:
python wagtailhooks.py or AppConfig.ready()
from wagtail.admin.api.views import PagesAdminAPIViewSet from wagtail.permissions import pagepermissionpolicy
def restrictedgetbasequeryset(self): return pagepermissionpolicy.explorableinstances(self.request.user)
PagesAdminAPIViewSet.getbasequeryset = restrictedgetbasequeryset
Acknowledgements
Many thanks to xuliang@QAX for reporting this issue.
For more information
If you have any questions or comments about this advisory:
- Visit Wagtail's support channels - Email us at security@wagtail.org (view our security policy for more information).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Configuration
If unable to upgrade, patch vulnerable admin API endpoints by overriding `PagesAdminAPIViewSet.get_base_queryset` to use access-controlled instances: set `PagesAdminAPIViewSet.get_base_queryset = _restricted_get_base_queryset`, where `_restricted_get_base_queryset(self)` returns `page_permission_policy.explorable_instances(self.request.user)`.
Wagtail admin API (PagesAdminAPIViewSet) get_base_queryset = Override PagesAdminAPIViewSet.get_base_queryset with _restricted_get_base_queryset
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs access to the Wagtail admin. Ordinary site visitors without Wagtail admin access cannot exploit it.
What data may be exposed?
The affected internal Pages admin API can return draft and live contents of fields declared in api_fields without access control. This includes base page fields such as title, slug, seo_title, and search_description, plus custom fields declared in api_fields.
Which releases contain the fix?
Patched releases are Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
What can be done if upgrading is not immediately possible?
Override PagesAdminAPIViewSet.get_base_queryset to return page_permission_policy.explorable_instances(self.request.user). The provided workaround can be placed in wagtail_hooks.py or AppConfig.ready() and is intended to patch all vulnerable admin API endpoints.