CVE-2021-20670
📋 TL;DR
CVE-2021-20670 is an improper access control vulnerability in GROWI wiki software that allows unauthenticated remote attackers to read user personal information and server internal data. This affects GROWI versions v4.2.2 and earlier. The vulnerability enables unauthorized access to sensitive information without requiring authentication.
💻 Affected Systems
- GROWI
📦 What is this software?
Growi by Weseek
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access all user personal data, internal server information, and potentially use this information for further attacks or data breaches.
Likely Case
Unauthenticated attackers reading user profiles, email addresses, and internal system information exposed through the GROWI application.
If Mitigated
Limited to authenticated users only accessing authorized information with proper access controls enforced.
🎯 Exploit Status
The vulnerability allows unauthenticated access but specific exploit vectors are unspecified in public disclosures.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v4.2.3 and later
Vendor Advisory: https://weseek.co.jp/security/2021/03/08/vulnerability/growi-prevent-multiple-xss/
Restart Required: Yes
Instructions:
1. Backup your GROWI data and configuration. 2. Update GROWI to version 4.2.3 or later. 3. Restart the GROWI service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to GROWI instances to trusted IP addresses only
iptables -A INPUT -p tcp --dport 3000 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p tcp --dport 3000 -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate GROWI instances from untrusted networks
- Deploy a web application firewall (WAF) with rules to detect and block unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check GROWI version via admin panel or by examining package.json file for version numberCheck Version:
grep version /path/to/growi/package.jsonVerify Fix Applied:
Confirm GROWI version is 4.2.3 or later and test that unauthenticated users cannot access user information📡 Detection & Monitoring
Log Indicators:
- Unauthenticated requests accessing user profile endpoints
- Multiple failed authentication attempts followed by successful information access
Network Indicators:
- Unusual traffic patterns to GROWI user data endpoints from unauthenticated sources
SIEM Query:
source="growi" AND (uri_path="/user/*" OR uri_path="/api/v3/user/*") AND http_status=200 AND NOT authenticated_user=*