Summary
The API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes.
The affected existing note can then not be accessed anymore and is effectively hidden by the new one.
Patches
This issue was fixed in 781263a
Details
When the freeURL feature is enabled (by setting the allowFreeURL config option or the CMD_ALLOW_FREEURL environment variable to true), any user with the appropriate permissions can create a note by making a POST request to the /new/<ALIAS> API endpoint. The <ALIAS> parameter can be set to the ID of an existing note.
HedgeDoc did not verify whether the provided <ALIAS> value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed.
Impact
Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note.
Attackers could use this issue to present a manipulated copy of the original note to the user, e.g. by replacing the links with malicious ones. Attackers can also use this issue to prevent access to the original note, causing a denial of service. No data is lost, as the original content of the affected notes is still present in the database.
Workarounds
Disabling freeURL mode prevents the exploitation of this issue.
The impact can be limited by restricting freeURL note creation to trusted, logged-in users by enabling requireFreeURLAuthentication/CMD_REQUIRE_FREEURL_AUTHENTICATION.
PoC
Make a POST request to /new/<ALIAS> with <ALIAS> being the ID of an existing note.
curl https://your.hedgedoc.instance/new/<ALIAS> -H "Content-Type: text/markdown" -d "some content"
For more information
If you have any questions or comments about this advisory:
Genygo Reporter
Summary
The API of HedgeDoc 1 can be used to create notes with an alias matching the ID of existing notes.
The affected existing note can then not be accessed anymore and is effectively hidden by the new one.
Patches
This issue was fixed in 781263a
Details
When the freeURL feature is enabled (by setting the
allowFreeURLconfig option or theCMD_ALLOW_FREEURLenvironment variable totrue), any user with the appropriate permissions can create a note by making a POST request to the/new/<ALIAS>API endpoint. The<ALIAS>parameter can be set to the ID of an existing note.HedgeDoc did not verify whether the provided
<ALIAS>value corresponds to a valid ID of an existing note and always allowed creation of the new note. When a visitor tried to access the existing note, HedgeDoc will first search for a note with a matching alias before it searches using the ID, therefore only the new note can be accessed.Impact
Depending on the permission settings of the HedgeDoc instance, the issue can be exploited only by logged-in users or by all (including non-logged-in) users. The exploit requires knowledge of the ID of the target note.
Attackers could use this issue to present a manipulated copy of the original note to the user, e.g. by replacing the links with malicious ones. Attackers can also use this issue to prevent access to the original note, causing a denial of service. No data is lost, as the original content of the affected notes is still present in the database.
Workarounds
Disabling freeURL mode prevents the exploitation of this issue.
The impact can be limited by restricting freeURL note creation to trusted, logged-in users by enabling
requireFreeURLAuthentication/CMD_REQUIRE_FREEURL_AUTHENTICATION.PoC
Make a POST request to
/new/<ALIAS>with<ALIAS>being the ID of an existing note.curl https://your.hedgedoc.instance/new/<ALIAS> -H "Content-Type: text/markdown" -d "some content"For more information
If you have any questions or comments about this advisory: