Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Incorrect access control in BookStack before v24.05.1 allows attackers to confirm existing system users and perform targeted notification email DoS via public facing forms.
Recommended action: Upgrade to 24.05.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In BookStack before version 0.30.4, a user with permissions to edit a page could insert JavaScript code through the use of javascript: URIs within a link or form which would run, within the context of the current page, when clicked or submitted. Additionally, a user with permissions to edit a page could insert a particular meta tag which could be used to silently redirect users to a alternative location upon visit of a page. Dangerous content may remain in the database but will be removed before being displayed on a page. If you think this could have been exploited the linked advisory provides a SQL query to test. As a workaround without upgrading, page edit permissions could be limited to only those that are trusted until you can upgrade although this will not address existing exploitation of this vulnerability. The issue is fixed in BookStack version 0.30.4.
Recommended action: Upgrade to 0.30.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Iframe tags don't have a sandbox attribute, this makes an attacker able to execute malicious javascript via an iframe and perform phishing attacks. The sandbox attribute will block script execution and prevents the content to navigate its top-level browsing context which will stop this type of attack.
Recommended action: Upgrade to 22.02.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
bookstack is vulnerable to Improper Access Control
Recommended action: Upgrade to 21.12.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(email, like, % . $search . %) to search for users based on email.
Recommended action: Upgrade to 21.11.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
bookstack is vulnerable to Cross-Site Request Forgery (CSRF)
Recommended action: Upgrade to 21.11 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
bookstack is vulnerable to Improper Access Control.
Recommended action: Upgrade to 21.11.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
bookstack is vulnerable to Unrestricted Upload of File with Dangerous Type.
Recommended action: Upgrade to 21.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact A user with permission to create comments could POST HTML directly to the system to be saved in a comment, which would then be executed/displayed to others users viewing the comment. Through this vulnerability custom JavaScript code could be injected and therefore ran on other user machines. This most impacts scenarios where not-trusted users are given permission to create comments. Patches The issue was addressed in BookStack v0.29.2. After upgrading, The command php artisan bookstack:regenerate-comment-content should be ran to remove any pre-existing dangerous content. Workarounds Comments can be disabled in the system settings to prevent them being shown to users. Alternatively, comment creation permissions can be altered as required to only those who are trusted but this will not address existing exploitation of this vulnerability. References BookStack Beta v0.29.2 JVN#41035278 BookStack Blog Post For more information If you have any questions or comments about this…
Recommended action: Upgrade to 0.29.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.