PT-2020-16404 · Hedgedoc · Hedgedoc

Published 2020-12-28 · Updated 2020-12-30 · CVE-2020-26286

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions HedgeDoc versions prior to 1.7.1

Description The issue allows an unauthenticated attacker to upload arbitrary files, including HTML, JS, and PHP files, to the upload storage backend. This can lead to potential security risks as uploaded files might still be served. It is recommended to verify that the uploaded file storage only contains allowed files.

Recommendations For versions prior to 1.7.1, update to version 1.7.1 to resolve the issue. As a temporary workaround, consider blocking the "/uploadimage" endpoint on your instance using your reverse proxy. Restrict MIME-types and file names served from your upload file storage to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-26286

GHSA-WCR3-XHV7-8GXC

Affected Products

Hedgedoc

References · 6

• https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8 · Patch
• https://osv.dev/vulnerability/CVE-2020-26286 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26286 · Security Note
• https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1 · Note
• https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxc · Note
• https://t.me/cvenotify/7856 · Telegram Post