Unauthorized access through URL manipulation in docassemble
Summary
GHSA-qrmm-w4v4-q7f8: Unauthorized access through URL manipulation. Affects docassemble versions < 1.2.65. Fixed in 1.2.65. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
docassemble is a package available on PyPI that provides a platform for creating interview-based legal documents. It allows users to define complex interviews using a simple markup language and generates dynamic interviews based on user input. The package is widely used in the legal community to automate document assembly processes.
Vulnerability Detail
The vulnerability in docassemble allows attackers to gain unauthorized access to information on the system through URL manipulation. By manipulating the URL parameters, an attacker can bypass authentication and access sensitive information. This can lead to unauthorized disclosure of confidential data and potential compromise of the system.
How To Fix
Minimum fixed version
1.2.65
This is the first release that contains the fix.
pip install --upgrade "docassemble==1.2.65"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not possible, a workaround is to manually apply the changes mentioned in the vulnerability advisory. The changes can be found in the commit e3dbf6ce054b3c0310996f0657289f5eed0a73fe. After applying the changes, the server needs to be restarted for the workaround to take effect.
Conclusion
In conclusion, the unauthorized access vulnerability in docassemble can be mitigated by upgrading to the patched versions or applying the provided workaround. It is important to take action to protect sensitive information and ensure the security of the system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for docassemble →
FAQ
docassemble is a package used for creating interview-based legal documents.
The vulnerability allows unauthorized access to information on the system, potentially leading to the disclosure of sensitive data.
The vulnerability can be fixed by upgrading to the patched versions of docassemble or by manually applying the changes mentioned in the vulnerability advisory.
Yes, a workaround is available by manually applying the changes mentioned in the vulnerability advisory and restarting the server.
The vulnerability was discovered by Jim Platania of Seiso LLC.
