CVE-2023-0737: wallabag Account Deletion via CSRF Vulnerability
Summary
CVE-2023-0737: CSRF leading to delete account in wallabag/wallabag. Affects wallabag/wallabag versions < 2.5.4. Fixed in 2.5.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wallabag is an open-source application designed for saving web articles for later reading. It allows users to manage their reading list and supports various features such as tagging, archiving, and sharing articles. The application is built using PHP and is widely used for personal knowledge management. However, version 2.5.2 of wallabag is vulnerable to a Cross-Site Request Forgery (CSRF) attack, which can lead to unauthorized account deletion.
Vulnerability Detail
The vulnerability arises from a lack of proper CSRF protection in wallabag version 2.5.2, specifically at the /account/delete endpoint. This flaw allows attackers to craft malicious requests that can be sent to the server without the user's consent. If a user is tricked into clicking a link or visiting a page controlled by the attacker while logged into wallabag, their account could be deleted without their knowledge. The ramifications of this vulnerability are significant, as it can lead to loss of user data and unauthorized access to user accounts.
How To Fix
Minimum fixed version
2.5.4
This is the first release that contains the fix.
composer require wallabag/wallabag:2.5.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional CSRF protection measures, such as ensuring that sensitive actions require a confirmation step or using tokens that validate requests. However, the best solution is to update to the patched version.
Conclusion
The CSRF vulnerability in wallabag version 2.5.2 poses a significant risk to user accounts, allowing for unauthorized deletions. It is crucial for users to update to version 2.5.4 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in the future.
See every vulnerability recorded for wallabag/wallabag →
FAQ
Cross-Site Request Forgery (CSRF) is a type of attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
If you are using wallabag version 2.5.2, your installation is vulnerable. You can check your version in the application settings or by looking at your composer.lock file.
The main consequence is the potential unauthorized deletion of user accounts, which can lead to loss of data and access to sensitive information.
Yes, tools like Vulert can monitor your composer.lock file for vulnerabilities in real-time, alerting you to any issues without requiring code access.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for wallabag/wallabag.
