Vulnerability-Lookup

CVE-2024-32882 (GCVE-0-2024-32882)

Vulnerability from cvelistv5 – Published: 2024-05-02 06:52 – Updated: 2024-08-02 02:20

Title

Permission check bypass when editing a model with per-field restrictions in wagtail

Summary

Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level.

Severity ?

2.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

CWE

CWE-280 - Improper Handling of Insufficient Permissions or Privileges
CWE-281 - Improper Preservation of Permissions

Assigner

GitHub_M

References

URL

Tags

	https://github.com/wagtail/wagtail/security/advis…	x_refsource_CONFIRM
	https://github.com/wagtail/wagtail/commit/ab2a5d8…	x_refsource_MISC
	https://docs.wagtail.org/en/stable/extending/gene…	x_refsource_MISC
	https://docs.wagtail.org/en/stable/reference/cont…	x_refsource_MISC
	https://docs.wagtail.org/en/stable/reference/page…	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	wagtail	wagtail	Affected: >= 6.0.0, < 6.0.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wagtail:wagtail:6.0.0:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "wagtail",
            "vendor": "wagtail",
            "versions": [
              {
                "lessThan": "6.0.3",
                "status": "affected",
                "version": "6.0.0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-32882",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-02T13:08:02.482926Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:50:26.488Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T02:20:35.672Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"
          },
          {
            "name": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"
          },
          {
            "name": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"
          },
          {
            "name": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"
          },
          {
            "name": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "wagtail",
          "vendor": "wagtail",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 6.0.0, \u003c 6.0.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-280",
              "description": "CWE-280: Improper Handling of Insufficient Permissions or Privileges ",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-281",
              "description": "CWE-281: Improper Preservation of Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-05-02T06:52:59.556Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"
        },
        {
          "name": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"
        },
        {
          "name": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"
        },
        {
          "name": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"
        },
        {
          "name": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"
        }
      ],
      "source": {
        "advisory": "GHSA-w2v8-php4-p8hc",
        "discovery": "UNKNOWN"
      },
      "title": "Permission check bypass when editing a model with per-field restrictions in wagtail"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-32882",
    "datePublished": "2024-05-02T06:52:59.556Z",
    "dateReserved": "2024-04-19T14:07:11.230Z",
    "dateUpdated": "2024-08-02T02:20:35.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Permission check bypass when editing a model with per-field restrictions in wagtail\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-280\", \"lang\": \"en\", \"description\": \"CWE-280: Improper Handling of Insufficient Permissions or Privileges \", \"type\": \"CWE\"}]}, {\"descriptions\": [{\"cweId\": \"CWE-281\", \"lang\": \"en\", \"description\": \"CWE-281: Improper Preservation of Permissions\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"NONE\", \"baseScore\": 2.7, \"baseSeverity\": \"LOW\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"LOW\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N\", \"version\": \"3.1\"}}], \"references\": [{\"name\": \"https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc\"}, {\"name\": \"https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b\"}, {\"name\": \"https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset\"}, {\"name\": \"https://docs.wagtail.org/en/stable/reference/contrib/settings.html\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://docs.wagtail.org/en/stable/reference/contrib/settings.html\"}, {\"name\": \"https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission\"}], \"affected\": [{\"vendor\": \"wagtail\", \"product\": \"wagtail\", \"versions\": [{\"version\": \"\u003e= 6.0.0, \u003c 6.0.3\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-05-02T06:52:59.556Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level.\"}], \"source\": {\"advisory\": \"GHSA-w2v8-php4-p8hc\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-32882\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-05-02T13:08:02.482926Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:wagtail:wagtail:6.0.0:*:*:*:*:*:*:*\"], \"vendor\": \"wagtail\", \"product\": \"wagtail\", \"versions\": [{\"status\": \"affected\", \"version\": \"6.0.0\", \"lessThan\": \"6.0.3\", \"versionType\": \"custom\"}], \"defaultStatus\": \"unknown\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-05-02T13:10:28.006Z\"}, \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-32882\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2024-04-19T14:07:11.230Z\", \"datePublished\": \"2024-05-02T06:52:59.556Z\", \"dateUpdated\": \"2024-06-04T17:50:26.488Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

GSD-2024-32882

Vulnerability from gsd - Updated: 2024-04-20 05:02

Details

** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Aliases

CVE-2024-32882

JSON

To clipboard

{
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2024-32882"
      ],
      "id": "GSD-2024-32882",
      "modified": "2024-04-20T05:02:00.257263Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2024-32882",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

FKIE_CVE-2024-32882

Vulnerability from fkie_nvd - Published: 2024-05-02 07:15 - Updated: 2024-11-21 09:15

Severity ?

2.7 (Low) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset
	security-advisories@github.com	https://docs.wagtail.org/en/stable/reference/contrib/settings.html
	security-advisories@github.com	https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission
	security-advisories@github.com	https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b
	security-advisories@github.com	https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc
	af854a3a-2127-422b-91ae-364da2661108	https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset
	af854a3a-2127-422b-91ae-364da2661108	https://docs.wagtail.org/en/stable/reference/contrib/settings.html
	af854a3a-2127-422b-91ae-364da2661108	https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b
	af854a3a-2127-422b-91ae-364da2661108	https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Wagtail is an open source content management system built on Django. In affected versions if a model has been made available for editing through the `wagtail.contrib.settings` module or `ModelViewSet`, and the `permission` argument on `FieldPanel` has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value. This vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected. Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected. Users are advised to upgrade. Site owners who are unable to upgrade to a patched version can avoid the vulnerability as follows: 1.For models registered through `ModelViewSet`, register the model as a snippet instead; 2. For settings models, place the restricted fields in a separate settings model, and configure permission at the model level."
    },
    {
      "lang": "es",
      "value": "Wagtail es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto construido sobre Django. En las versiones afectadas, si un modelo se ha puesto a disposici\u00f3n para su edici\u00f3n a trav\u00e9s del m\u00f3dulo `wagtail.contrib.settings` o `ModelViewSet`, y el argumento `permission` en `FieldPanel` se ha utilizado para restringir a\u00fan m\u00e1s el acceso a uno o m\u00e1s campos de En el modelo, un usuario con permiso de edici\u00f3n sobre el modelo pero no sobre el campo espec\u00edfico puede crear una solicitud HTTP POST que omita la verificaci\u00f3n de permiso en el campo individual, permiti\u00e9ndole actualizar su valor. Esta vulnerabilidad no es aprovechable por un visitante normal del sitio sin acceso al administrador de Wagtail, ni por un usuario al que no se le ha concedido acceso de edici\u00f3n al modelo en cuesti\u00f3n. Las interfaces de edici\u00f3n de p\u00e1ginas y fragmentos tampoco se ven afectadas. Se han lanzado versiones parcheadas como Wagtail 6.0.3 y 6.1. Las versiones de Wagtail anteriores a la 6.0 no se ven afectadas. Se recomienda a los usuarios que actualicen. Los propietarios de sitios que no puedan actualizar a una versi\u00f3n parcheada pueden evitar la vulnerabilidad de la siguiente manera: 1. Para los modelos registrados a trav\u00e9s de `ModelViewSet`, registre el modelo como un fragmento; 2. Para los modelos de configuraci\u00f3n, coloque los campos restringidos en un modelo de configuraci\u00f3n separado y configure el permiso en el nivel del modelo."
    }
  ],
  "id": "CVE-2024-32882",
  "lastModified": "2024-11-21T09:15:55.913",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 2.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-05-02T07:15:20.967",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-280"
        },
        {
          "lang": "en",
          "value": "CWE-281"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-W2V8-PHP4-P8HC

Vulnerability from github – Published: 2024-05-01 16:35 – Updated: 2024-05-02 19:35

Summary

Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`

Details

Impact

If a model has been made available for editing through the wagtail.contrib.settings module or ModelViewSet, and the permission argument on FieldPanel has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value.

The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected.

Patches

Patched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected.

Workarounds

Site owners who are unable to upgrade to a patched version can avoid the vulnerability in ModelViewSet by registering the model as a snippet instead. No workaround is available for wagtail.contrib.settings.

Acknowledgements

Many thanks to Ben Morse and Joshua Munn for reporting this issue.

For more information

If you have any questions or comments about this advisory:

Visit Wagtail's support channels
Email us at security@wagtail.org (view our security policy for more information).

Severity ?

2.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "wagtail"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-32882"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-280"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-05-01T16:35:13Z",
    "nvd_published_at": "2024-05-02T07:15:20Z",
    "severity": "LOW"
  },
  "details": "### Impact\nIf a model has been made available for editing through the [`wagtail.contrib.settings`](https://docs.wagtail.org/en/stable/reference/contrib/settings.html) module or [`ModelViewSet`](https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset), and the [`permission` argument on `FieldPanel`](https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission) has been used to further restrict access to one or more fields of the model, a user with edit permission over the model but not the specific field can craft an HTTP POST request that bypasses the permission check on the individual field, allowing them to update its value.\n\nThe vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin, or by a user who has not been granted edit access to the model in question. The editing interfaces for pages and snippets are also unaffected.\n\n### Patches\nPatched versions have been released as Wagtail 6.0.3 and 6.1. Wagtail releases prior to 6.0 are unaffected.\n\n### Workarounds\nSite owners who are unable to upgrade to a patched version can avoid the vulnerability in `ModelViewSet` by registering the model as a snippet instead. No workaround is available for `wagtail.contrib.settings`.\n\n### Acknowledgements\nMany thanks to Ben Morse and Joshua Munn for reporting this issue.\n\n### For more information\nIf you have any questions or comments about this advisory:\n\n* Visit Wagtail\u0027s [support channels](https://docs.wagtail.io/en/stable/support.html)\n* Email us at [security@wagtail.org](mailto:security@wagtail.org) (view our [security policy](https://github.com/wagtail/wagtail/security/policy) for more information).",
  "id": "GHSA-w2v8-php4-p8hc",
  "modified": "2024-05-02T19:35:19Z",
  "published": "2024-05-01T16:35:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32882"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/commit/fa0d4829f9c81eefb37cc058e2fa1b6a918741da"
    },
    {
      "type": "WEB",
      "url": "https://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset"
    },
    {
      "type": "WEB",
      "url": "https://docs.wagtail.org/en/stable/reference/contrib/settings.html"
    },
    {
      "type": "WEB",
      "url": "https://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/wagtail/wagtail"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wagtail/wagtail/releases/tag/v6.0.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Wagtail has permission check bypass when editing a model with per-field restrictions through `wagtail.contrib.settings` or `ModelViewSet`"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2024-32882 (GCVE-0-2024-32882)

GSD-2024-32882

FKIE_CVE-2024-32882

GHSA-W2V8-PHP4-P8HC

Impact

Patches

Workarounds

Acknowledgements

For more information

Tags

Sightings

Nomenclature