CVE-2022-23654
📋 TL;DR
Wiki.js versions before 2.5.274 contain an improper authentication vulnerability (CWE-287) where authenticated users with write access to restricted paths can update pages outside their allowed scope. By manipulating page IDs while keeping path values unchanged, attackers bypass path-based access controls. This affects all Wiki.js deployments with user accounts having restricted write permissions.
💻 Affected Systems
- Wiki.js
📦 What is this software?
Wiki.js by Requarks
⚠️ Risk & Real-World Impact
Worst Case
Privileged authenticated user could modify or delete any wiki page, potentially defacing content, injecting malicious scripts, or deleting critical documentation.
Likely Case
Users with limited write permissions could escalate privileges by modifying pages they shouldn't have access to, potentially accessing sensitive information or disrupting operations.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized modifications within the wiki system only.
🎯 Exploit Status
Exploitation requires authenticated user account with some write permissions. The vulnerability is straightforward to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.274 and later
Vendor Advisory: https://github.com/Requarks/wiki/security/advisories/GHSA-3cv9-795v-6j7j
Restart Required: Yes
Instructions:
1. Backup your wiki data. 2. Update Wiki.js to version 2.5.274 or later using your package manager or download from GitHub. 3. Restart the Wiki.js service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Temporary Access Restriction
allTemporarily restrict write access for all users or implement additional access control layer
🧯 If You Can't Patch
- Implement strict access controls and audit all user permissions
- Enable detailed logging of all page modification attempts and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Wiki.js version in admin panel or run: node -e "console.log(require('./package.json').version)" from Wiki.js directoryCheck Version:
node -e "console.log(require('./package.json').version)"Verify Fix Applied:
Confirm version is 2.5.274 or higher and test that users cannot modify pages outside their assigned paths📡 Detection & Monitoring
Log Indicators:
- Multiple failed access attempts to restricted paths
- User modifying pages with IDs outside their normal pattern
- Access denied logs followed by successful modifications
Network Indicators:
- Unusual API call patterns to page update endpoints
SIEM Query:
source="wiki.js" AND (event="page_update" OR event="page_move") AND user.permissions="restricted" AND target_path!="allowed_path*"🔗 References
- https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b
- https://github.com/Requarks/wiki/security/advisories/GHSA-3cv9-795v-6j7j
- https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b
- https://github.com/Requarks/wiki/security/advisories/GHSA-3cv9-795v-6j7j
