CVE-2020-26286
In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.42%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
HedgeDoc is a collaborative platform for writing and sharing markdown. In HedgeDoc before version 1.7.1 an unauthenticated attacker can upload arbitrary files to the upload storage backend including HTML, JS and PHP files. The problem is patched in HedgeDoc 1.7.1. You should however verify that your uploaded file storage only contains files that are allowed, as uploaded files might still be served. As workaround it's possible to block the `/uploadimage` endpoint on your instance using your reverse proxy. And/or restrict MIME-types and file names served from your upload file storage.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- EPSS
- 1.42% probability · 71th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- hedgedoc/hedgedoc
- Source
- security-advisories@github.com
References
- https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8Patch, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxcThird Party Advisory
- https://github.com/hedgedoc/hedgedoc/commit/e9306991cdb5ff2752c1eeba3fedba42aec3c2d8Patch, Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/releases/tag/1.7.1Third Party Advisory
- https://github.com/hedgedoc/hedgedoc/security/advisories/GHSA-wcr3-xhv7-8gxcThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.