CVE-2021-29434: Improper validation of URLs in Wagtail rich text fields

Background

Wagtail is an open-source content management system (CMS) written in Python. It provides a flexible and user-friendly interface for managing website content. The rich text fields in Wagtail allow users to create and edit content with formatting options. However, a vulnerability has been discovered in the way Wagtail handles URLs in these rich text fields.

Vulnerability Detail

The vulnerability in Wagtail arises from the lack of server-side validation of link URLs in the admin interface. When saving the contents of a rich text field, Wagtail does not enforce checks to ensure that the URLs use a valid protocol. This allows a malicious user with access to the admin interface to craft a POST request containing javascript: URLs with arbitrary code. It is important to note that this vulnerability is not exploitable by ordinary site visitors without admin access.

pip install --upgrade "wagtail==8.0.1"

Workaround

For sites that cannot easily upgrade to the patched versions, a temporary workaround can be implemented by adding the following code to a wagtail_hooks.py module in any installed app:

from draftjs_exporter.dom import DOM
from wagtail.admin.rich_text.converters.html_to_contentstate import ExternalLinkElementHandler, PageLinkElementHandler
from wagtail.core import hooks
from wagtail.core.whitelist import check_url


def link_entity(props):
    id_ = props.get('id')
    link_props = {}

    if id_ is not None:
        link_props['linktype'] = 'page'
        link_props['id'] = id_
    else:
        link_props['href'] = check_url(props.get('url'))

    return DOM.create_element('a', link_props, props['children'])


@hooks.register('register_rich_text_features', order=1)
def register_link(features):
    features.register_converter_rule('contentstate', 'link', {
        'from_database_format': {
            'a[href]': ExternalLinkElementHandler('LINK'),
            'a[linktype="page"]': PageLinkElementHandler('LINK'),
        },
        'to_database_format': {
            'entity_decorators': {'LINK': link_entity}
        }
    })

This code adds a custom link converter rule that applies server-side checks for valid protocols. It ensures that only safe URLs are allowed in the rich text fields.

Conclusion

The vulnerability in Wagtail's rich text fields allows for the execution of arbitrary code through crafted javascript: URLs. To mitigate this risk, it is crucial to upgrade to the patched versions of Wagtail (2.11.7 or 2.12.4). Alternatively, a temporary workaround can be implemented by adding custom code to enforce server-side checks. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for wagtail →

FAQ