Wallabag Stored XSS & SSRF Vulnerability Analysis (CVSS 8.5, POC included)

Vulnerability Summary: WALLABAG-FULL-DISCLOSURE-Stored-XSS-SSRF-CVSS-8.5-GHSA-q2g2-ww6-wf5h Vulnerability Overview Type: Stored XSS + Server-Side Request Forgery (SSRF) CVSS Score: 8.5 GHSA ID: GHSA-q2g2-ww6-wf5h Status: Closed (commit not merged); a 2.6 version upgrade merge will be managed subsequently. Scope of Impact Affected Component Versions: - Wallabag: 2.7.0-dev (commit 450a3c, branch master) / Stable version 2.6.14 - TCGPDF: 6.11.3 - html_lawed (fossar/htmlawed): 1.3.3 - HTMLPurifier: not installed (not present) Impact: - Stored XSS: JavaScript can execute when any authenticated user views an article, enabling session hijacking and account takeover. - SSRF: The Wallabag server can initiate arbitrary HTTP requests to access internal network resources (cloud metadata, Redis, internal APIs). - Chained RCE: In cloud environments with IMDSv1, SSFR can read IAM credentials, leading to full cloud account takeover. Vulnerability Details 1 — Lack of Sanitization (Stored XSS) (lines 96–965): (line 263): Both fields are serialized and exposed via the REST API ( ) and rendered as in Twig templates. 2 — SSFR via TCGPDF (Unsanitized Content Passed to PDF Renderer) (lines 296–300): TCGPDF (v6.11.3) treats URLs within as server-side requests, with no protocol or host allowlisting in the code. POC Code Step 1 — Attacker creates a malicious entry Step 2 — Trigger PDF Export (attacker's own account suffices) Result: The Wallabag server initiates an HTTP GET request to . In AWS/GCP/Azure environments, if IMDSv1 is enabled, IAM credentials will be returned. The same technique can also read local files (e.g., ). Remediation Remediation #1 (Custom Logic): FUNFACTORI created a temporary private branch , based on a "close/defer" assignment model, requesting review, merge, and CVE assignment, with a 7-day deadline. Remediation #2 (Introducing HTMLPurifier): - Resubmitted PR #1 based on the 2.6 branch - Requested 7 modifications: - Include update: Introduce as a dependency - Title update: Recommend replacing with - Optimization: Remove redundant code in templates Final Status: - No response: Maintainers did not respond for a month after the final deadline of July 10 - PR #2 was closed due to unmerged commits - Wallabag 2.6.14 was released but did not include the fix - No CVE assigned: The security advisory remained in "Draft" status, with no official CVE

Goal Reached Thanks to every supporter — we hit 100%!

Wallabag Stored XSS & SSRF Vulnerability Analysis (CVSS 8.5, POC included)

More from this source