Permission check bypass in Wagtail

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU89161

Risk: Low

CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-32882

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to application does not properly impose security restrictions when editing a model with per-field restrictions through "wagtail.contrib.settings" or "ModelViewSet". A remote administrator can craft an HTTP POST request that bypasses the permission check on the individual field and update its value.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

wagtail: 6.0 - 6.0.2

External links

http://github.com/wagtail/wagtail/security/advisories/GHSA-w2v8-php4-p8hc
http://github.com/wagtail/wagtail/commit/ab2a5d82b4ee3c909d2456704388ccf90e367c9b
http://docs.wagtail.org/en/stable/extending/generic_views.html#modelviewset
http://docs.wagtail.org/en/stable/reference/contrib/settings.html
http://docs.wagtail.org/en/stable/reference/pages/panels.html#wagtail.admin.panels.FieldPanel.permission

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.