Impact A low-level user with the "Can submit translation" permission can create translations for any page, including those they do not have permissions for.
Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds N/A
Acknowledgements
Many thanks to @devansh3008 and @alanturing881 for reporting this issue.
For more information
If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds For sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to urls.py URL pattern declarations to override the vulnerable view.
python from django.core.exceptions import PermissionDenied from django.shortcuts import getobjector404 from django.urls import path from wagtail.admin import urls as wagtailadminurls from wagtail.images.permissions import permissionpolicy from wagtail.images.views import preview
def patchedpreview(request, imageid, filterspec): image = getobjector404(getimagemodel(), id=imageid)
if not permissionpolicy.userhaspermissionforinstance(request.user, "change", image): raise PermissionDenied
return preview(request, imageid, filterspec)
urlpatterns = [ # Example where the CMS admin is at /admin/. # Add this before the Wagtail admin URLs registration, with the same sub-path. path("admin/images/<int:imageid>/preview/<str:filterspec>/", patchedpreview) path("admin/", include(wagtailadminurls)), ]
Acknowledgements Many thanks to @0x1saac and @harshakshit for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Impact The Documents and Images chooser's chosen endpoint incorrectly listed items for which the user has not been granted choose permission. A user with access to the Wagtail admin could see the filename and name and URLs of documents and images in those collections.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds N/A
Acknowledgements Many thanks to @harshakshit for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Impact
An authenticated admin user can trigger expensive rendition processing with purposefully crafted filter specs resulting in potentially service degradation.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches Patched versions have been released as Wagtail 7.0.8, 7.3.3, 7.4.2.
Workarounds For sites that cannot easily upgrade to a current supported version, the vulnerability can be patched by adding the following code to urls.py URL pattern declarations to override the vulnerable view.
python from django.core.exceptions import PermissionDenied from django.http import HttpResponseBadRequest from django.shortcuts import getobjector404 from django.urls import path from wagtail.admin import urls as wagtailadminurls from wagtail.images.exceptions import InvalidFilterSpecError from wagtail.images.permissions import permissionpolicy from wagtail.images.views import preview
def patchedpreview(request, imageid, filterspec): image = getobjector404(getimagemodel(), id=imageid)
if not permissionpolicy.userhaspermissionforinstance(request.user, "change", image): raise PermissionDenied
try: filterobj = Filter(spec=filterspec) except InvalidFilterSpecError: return HttpResponseBadRequest("Invalid filter spec", contenttype="text/plain")
allowed = {"original", "width", "height", "min", "max", "fill"} if any(operation.method not in allowed for operation in filterobj.operations): return HttpResponseBadRequest("Invalid filter spec", contenttype="text/plain")
return preview(request, imageid, filterspec)
urlpatterns = [ # Example where the CMS admin is at /admin/. # Add this before the Wagtail admin URLs registration, with the same sub-path. path("admin/images/<int:imageid>/preview/<str:filterspec>/", patchedpreview) path("admin/", include(wagtailadminurls)), ]
Acknowledgements Many thanks to @0x1saac for reporting this issue.
For more information If you have any questions or comments about this advisory:
Visit Wagtail's support channels Email us at security@wagtail.org (view our security policy for more information).
Impact
A CMS user with limited access to pages could copy a page they don't have access to to an area of the site they do. Once copied, they'd be able to view its contents, and potentially publish it. Permissions were correctly checked for the copy destination, but not for the source page.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.
For more information If there are any questions or comments about this advisory:
Visit Wagtail's support channels Send an email to security@wagtail.org (view the security policy for more information).
Impact
The Documents and Images API incorrectly listed items in private collections. A user with access to the API could see the filename and name of documents and images in private collections.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
Site owners using Wagtail's API can avoid the vulnerability by adding authentication to the Documents and Images APIs.
Acknowledgements
Wagtail thanks independent security researcher Sanjok Karki @thesanjok for reporting this issue.
For more information If there are any questions or comments about this advisory:
Visit Wagtail's support channels Send an email to security@wagtail.org (view the security policy for more information).
Impact
A CMS user with limited access to form pages could delete submissions to form pages they don't have access to by crafting a form submission to delete submissions on a page they do have access to for submissions they don't.
The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks Vishal Shukla @shukla304 for reporting this issue.
For more information If there are any questions or comments about this advisory:
Visit Wagtail's support channels Send an email to security@wagtail.org (view the security policy for more information).
Impact
A CMS user without the ability to edit a page could still access the history report for the page, potentially resulting in disclosure of sensitive information.
Patches Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Wagtail thanks Seoyoung Kang @seoyoung-kang who is from AhnLab and also an independent security researcher for reporting this issue.
For more information If there are any questions or comments about this advisory:
Visit Wagtail's support channels Send an email to security@wagtail.org (view the security policy for more information).
Impact
A CMS user without the ability to edit a page could access revisions of the page through the revision compare view if they knew the primary key of two revisions. This could potentially result in disclosure of sensitive information.
Patches
Patched versions have been released as Wagtail 7.0.7 and 7.3.2. The new 7.4 LTS feature release also incorporates this fix.
Workarounds
No workaround is available.
Acknowledgements
Many thanks to Seoyoung Kang @seoyoung-kang from AhnLab and an independent security researcher for reporting this issue.
For more information If there are any questions or comments about this advisory:
Visit Wagtail's support channels Send an email to security@wagtail.org (view the security policy for more information).
Impact A stored Cross-site Scripting (XSS) vulnerability exists on confirmation messages within the wagtail.contrib.simpletranslation module. A user with access to the Wagtail admin area may create a page with a specially-crafted title which, when another user performs the "Translate" action, causes arbitrary JavaScript code to run. This could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.
Workarounds None
Acknowledgements
Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels - Email Wagtail at security@wagtail.org (view the security policy for more information).
Impact A stored Cross-site Scripting (XSS) vulnerability exists on rendering TableBlock blocks within a StreamField. A user with access to create or edit pages containing TableBlock StreamField blocks is able to set specially-crafted class attributes on the block which run arbitrary JavaScript code when the page is viewed. When viewed by a user with higher privileges, this could lead to performing actions with that user's credentials. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, and only affects sites using TableBlock.
Patches Patched versions have been released as Wagtail 6.3.8, 7.0.6, 7.2.3 and 7.3.1.
Workarounds Site owners who are unable to upgrade to the new versions can remediate the vulnerability by setting a template attribute on all TableBlock definitions, referencing a template that does not output class attributes. For example:
django <!-- For use with TableBlock(template="path/to/tableblock.html") --> <table> {% if tablecaption %} <caption>{{ tablecaption }}</caption> {% endif %} {% if tableheader %} <thead> <tr> {% for cell in tableheader %} <th scope="col">{{ cell }}</th> {% endfor %} </tr> </thead> {% endif %} <tbody> {% for row in data %} <tr> {% for cell in row %} {% if firstcolisheader and forloop.first %} <th scope="row">{{ cell }}</th> {% else %} <td>{{ cell }}</td> {% endif %} {% endfor %} </tr> {% endfor %} </tbody> </table>
Acknowledgements
Many thanks to Guan Chenxian (@GCXWLP) for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels - Email Wagtail at security@wagtail.org (view the security policy for more information).
Impact Due to a missing permission check on the preview endpoints, a user with access to the Wagtail admin and knowledge of a model's fields can craft a form submission to obtain a preview rendering of any page, snippet or site setting object for which previews are enabled, consisting of any data of the user's choosing. The existing data of the object itself is not exposed, but depending on the nature of the template being rendered, this may expose other database contents that would otherwise only be accessible to users with edit access over the model. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin.
Patches Patched versions have been released as Wagtail 6.3.6, 7.0.4, 7.1.3 and 7.2.2. The new 7.3 feature release also incorporates this fix.
Workarounds No workaround is available.
Acknowledgements
Many thanks to @thxtech for reporting this issue.
For more information
If there are any questions or comments about this advisory:
- Visit Wagtail's support channels - Send an email to security@wagtail.org (view our security policy for more information).