GHSA-c2xx-cjmh-9q8f: Medium severity pip/wagtail vulnerability
Impact
The Documents and Images API V2 incorrectly listed items in descendants of private collections, which should inherit the view restrictions defined on their ancestors. A user with access to the API could see the filename and name of documents and images in these descendant collections.
Patches
Patched versions have been released as Wagtail 7.0.9, 7.3.4, 7.4.3 and 8.0rc2.
Workarounds
Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.
Acknowledgements
Many thanks to Ta Duc Thien for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
pip/wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.0.9 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.3.4 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 7.4.3 - Upgrade
Upgrade
wagtailto a version that resolves this vulnerability.Fixed in 8.0rc2 - Configuration
Enable authentication for the Documents and Images APIs (so only authenticated access can enumerate filenames/names in descendant collections).
Wagtail Documents and Images API V2 authentication = enabled
Event History
Frequently Asked Questions
Who can retrieve the exposed metadata?
A user with access to Wagtail’s API V2 can see the filename and name of documents and images stored in descendant collections of private collections. The issue affects the Documents and Images APIs.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied severity vector. Exposure depends on the affected Documents and Images API endpoints being accessible.
Which versions contain fixes?
Fixed releases are Wagtail 7.0.9, 7.3.4, 7.4.3, and 8.0rc2.
What can be done if an upgrade cannot be applied immediately?
Configure authentication for the Documents and Images APIs. This prevents unauthenticated API users from viewing the affected document and image metadata.