Summary
YesWiki contains a cross-site request forgery vulnerability in the despam action that can cause an authenticated administrator's browser to submit page-management requests without the administrator's intentional approval. An attacker may abuse this behavior to delete, restore, or overwrite wiki content when an administrator views attacker-controlled HTML.
YesWiki contains a cross-site request forgery vulnerability in the despam action that can cause an authenticated administrator's browser to submit page-management requests without the administrator's intentional approval. An attacker may abuse this behavior to delete, restore, or overwrite wiki content when an administrator views attacker-controlled HTML.
Affected context
The issue occurs in YesWiki deployments where the despam action accepts state-changing requests without sufficiently binding them to the administrator's intended interaction. Risk is higher when unauthenticated users can publish or influence wiki content containing raw HTML and an administrator may view that content while authenticated. The affected operations include requests involving page deletion, restoration, and replacement of current content.
The issue occurs in YesWiki deployments where the despam action accepts state-changing requests without sufficiently binding them to the administrator's intended interaction. Risk is higher when unauthenticated users can publish or influence wiki content containing raw HTML and an administrator may view that content while authenticated. The affected operations include requests involving page deletion, restoration, and replacement of current content.
Exploit preconditions
- Attack surface: The YesWiki despam action and its page-management request handlers
- Required access: The attacker generally needs only the ability to place or influence content that an administrator will view; the victim must have an authenticated administrator session
- Trigger point: The administrator's browser submits an attacker-prepared form or equivalent cross-origin request
- Why exploitation is possible: The server accepts a state-changing request based primarily on the administrator's session credentials without adequately verifying that the request originated from an intentional same-site action
- Attack surface: The YesWiki despam action and its page-management request handlers
- Required access: The attacker generally needs only the ability to place or influence content that an administrator will view; the victim must have an authenticated administrator session
- Trigger point: The administrator's browser submits an attacker-prepared form or equivalent cross-origin request
- Why exploitation is possible: The server accepts a state-changing request based primarily on the administrator's session credentials without adequately verifying that the request originated from an intentional same-site action
Why this happens
The underlying bug is missing or ineffective request-origin validation for state-changing operations. A browser automatically includes the administrator's session credentials when submitting a cross-site request, and the despam action processes parameters affecting wiki pages without a sufficiently reliable CSRF token or equivalent defense. This maps to CWE-352: Cross-Site Request Forgery, in which an application confuses a browser's authenticated request with an action deliberately initiated by the authenticated user.
The underlying bug is missing or ineffective request-origin validation for state-changing operations. A browser automatically includes the administrator's session credentials when submitting a cross-site request, and the despam action processes parameters affecting wiki pages without a sufficiently reliable CSRF token or equivalent defense. This maps to CWE-352: Cross-Site Request Forgery, in which an application confuses a browser's authenticated request with an action deliberately initiated by the authenticated user.
Potential impact
- An attacker may delete important wiki pages or configuration content
- An attacker may restore previously removed pages without authorization
- An attacker may overwrite current page content
- Administrative workflows and wiki integrity could be disrupted
- Configuration changes could potentially affect application behavior
- An attacker may delete important wiki pages or configuration content
- An attacker may restore previously removed pages without authorization
- An attacker may overwrite current page content
- Administrative workflows and wiki integrity could be disrupted
- Configuration changes could potentially affect application behavior
General mitigation guidance
Mitigation generally focuses on ensuring that every state-changing action
requires proof of user intent and follows a secure request-handling pattern.
Common defensive approaches include:
- Requiring unpredictable, session-bound CSRF tokens for state-changing requests
- Validating request origin and enforcing appropriate SameSite cookie protections
- Avoiding state changes through GET requests or automatically submitted forms
- Applying strict server-side authorization and input validation to page-management parameters
- Limiting who can publish raw HTML or other content capable of influencing administrator browsers
- Using least privilege for administrative roles and protecting sensitive configuration pages
Mitigation generally focuses on ensuring that every state-changing action
requires proof of user intent and follows a secure request-handling pattern.
Common defensive approaches include:
- Requiring unpredictable, session-bound CSRF tokens for state-changing requests
- Validating request origin and enforcing appropriate SameSite cookie protections
- Avoiding state changes through GET requests or automatically submitted forms
- Applying strict server-side authorization and input validation to page-management parameters
- Limiting who can publish raw HTML or other content capable of influencing administrator browsers
- Using least privilege for administrative roles and protecting sensitive configuration pages
How teams detect issues like this
Organizations can look for CSRF exposure through:
- Static analysis and code review checks for state-changing handlers lacking token validation
- Review of endpoints that accept deletion, restoration, or content-replacement parameters
- Tests that submit cross-origin requests with an authenticated session and verify rejection
- Policy enforcement requiring CSRF middleware or equivalent protections for non-idempotent actions
- Monitoring unusual administrative page-management activity and unexpected content changes
Automated security review tools may help identify forms and endpoints that modify server state without clear anti-CSRF controls.
Organizations can look for CSRF exposure through:
- Static analysis and code review checks for state-changing handlers lacking token validation
- Review of endpoints that accept deletion, restoration, or content-replacement parameters
- Tests that submit cross-origin requests with an authenticated session and verify rejection
- Policy enforcement requiring CSRF middleware or equivalent protections for non-idempotent actions
- Monitoring unusual administrative page-management activity and unexpected content changes
Automated security review tools may help identify forms and endpoints that modify server state without clear anti-CSRF controls.
