PT-2021-23163 · Bookstack · Bookstack

Haxatron · Published 2021-12-15 · Updated 2022-08-09 · CVE-2021-4119

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BookStack versions prior to 21.11.3

Description The issue allows a logged-in user with no privileges or a guest user (if public access is enabled) to access the "/search/users/select" AJAX endpoint, which is meant for admins to manage audit logs. This can be used to dump all usernames existing in the BookStack database. Additionally, it can be used to harvest email belonging to a user because BookStack uses the code where(email, like, % . $search . %) to search for users based on email.

Recommendations For versions prior to 21.11.3, update to version 21.11.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/search/users/select" AJAX endpoint to minimize the risk of exploitation. Avoid using the email variable in the affected endpoint until the issue is resolved.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2021-4119

GHSA-9C5C-5J4H-8Q2C

Affected Products

Bookstack

References · 8

• 🔥 https://huntr.dev/bounties/135f2d7d-ab0b-4351-99b9-889efac46fca · Exploit
• https://github.com/bookstackapp/bookstack/commit/e765e618547c92f4e0b46caca6fb91f0174efd99 · Patch
• https://osv.dev/vulnerability/CVE-2021-4119 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9c5c-5j4h-8q2c · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4119 · Security Note
• https://github.com/BookStackApp/BookStack/releases/tag/v21.11.3 · Note
• https://github.com/bookstackapp/bookstack · Note
• https://t.me/cibsecurity/34095 · Telegram Post