BookStack is vulnerable to Improper Access Control.
The advisory, in context
BookStack prior to version 21.11.3 is vulnerable to Improper Access Control. A logged-in user with no privileges OR guest user (if public access enabled) can access the /search/users/select AJAX endpoint meant for admins to manage audit logs, to dump all usernames existing in the Bookstack database. This can also be used to harvest email belonging to a user because BookStack also uses the code where(email, like, % . $search . %) to search for users based on email.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 21.11.3
Fixed in 21.11.3
132 explicitly affected versions
0.7.2, V0.7.5, v0.10.0, v0.11.0, v0.11.1, v0.11.2, v0.12.0, v0.12.1, v0.12.2, v0.13.0, v0.13.1, v0.14.0, v0.14.1, v0.14.2, v0.14.3, v0.15.0, v0.15.1, v0.15.2, v0.15.3, v0.16.0, v0.16.1, v0.16.2, v0.16.3, v0.17.0, v0.17.1, v0.17.2, v0.17.3, v0.17.4, v0.18.0, v0.18.1, v0.18.2, v0.18.3, v0.18.4, v0.18.5, v0.19.0, v0.20.0, v0.20.1, v0.20.2, v0.20.3, v0.21.0, v0.22.0, v0.23.0, v0.23.1, v0.23.2, v0.24.0, v0.24.1, v0.24.2, v0.24.3, v0.25.0, v0.25.1, v0.25.2, v0.25.3, v0.25.4, v0.25.5, v0.26.0, v0.26.1, v0.26.2, v0.26.3, v0.26.4, v0.27, v0.27.1, v0.27.2, v0.27.3, v0.27.4, v0.27.5, v0.28.0, v0.28.1, v0.28.2, v0.28.3, v0.29.0, v0.29.1, v0.29.2, v0.29.3, v0.30.0, v0.30.1, v0.30.2, v0.30.3, v0.30.4, v0.30.5, v0.30.6, v0.30.7, v0.31.0, v0.31.1, v0.31.2, v0.31.3, v0.31.4, v0.31.5, v0.31.6, v0.31.7, v0.31.8, v0.5.0, v0.6.0, v0.6.1, v0.6.2, v0.6.3, v0.7.0, v0.7.3, v0.7.4, v0.7.6, v0.8.0, v0.8.1, v0.8.2, v0.9.0, v0.9.1, v0.9.2, v0.9.3, v21.04, v21.04.1, v21.04.2, v21.04.3, v21.04.4, v21.04.5, v21.04.6, v21.05, v21.05.1, v21.05.2, v21.05.3, v21.05.4, v21.08, v21.08.1, v21.08.2, v21.08.3, v21.08.4, v21.08.5, v21.08.6, v21.10, v21.10.1, v21.10.2, v21.10.3, v21.11, v21.11.1, v21.11.2
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "21.11.3"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.7.2",
"V0.7.5",
"v0.10.0",
"v0.11.0",
"v0.11.1",
"v0.11.2",
"v0.12.0",
"v0.12.1",
"v0.12.2",
"v0.13.0",
"v0.13.1",
"v0.14.0",
"v0.14.1",
"v0.14.2",
"v0.14.3",
"v0.15.0",
"v0.15.1",
"v0.15.2",
"v0.15.3",
"v0.16.0",
"v0.16.1",
"v0.16.2",
"v0.16.3",
"v0.17.0",
"v0.17.1",
"v0.17.2",
"v0.17.3",
"v0.17.4",
"v0.18.0",
"v0.18.1",
"v0.18.2",
"v0.18.3",
"v0.18.4",
"v0.18.5",
"v0.19.0",
"v0.20.0",
"v0.20.1",
"v0.20.2",
"v0.20.3",
"v0.21.0",
"v0.22.0",
"v0.23.0",
"v0.23.1",
"v0.23.2",
"v0.24.0",
"v0.24.1",
"v0.24.2",
"v0.24.3",
"v0.25.0",
"v0.25.1",
"v0.25.2",
"v0.25.3",
"v0.25.4",
"v0.25.5",
"v0.26.0",
"v0.26.1",
"v0.26.2",
"v0.26.3",
"v0.26.4",
"v0.27",
"v0.27.1",
"v0.27.2",
"v0.27.3",
"v0.27.4",
"v0.27.5",
"v0.28.0",
"v0.28.1",
"v0.28.2",
"v0.28.3",
"v0.29.0",
"v0.29.1",
"v0.29.2",
"v0.29.3",
"v0.30.0",
"v0.30.1",
"v0.30.2",
"v0.30.3",
"v0.30.4",
"v0.30.5",
"v0.30.6",
"v0.30.7",
"v0.31.0",
"v0.31.1",
"v0.31.2",
"v0.31.3",
"v0.31.4",
"v0.31.5",
"v0.31.6",
"v0.31.7",
"v0.31.8",
"v0.5.0",
"v0.6.0",
"v0.6.1",
"v0.6.2",
"v0.6.3",
"v0.7.0",
"v0.7.3",
"v0.7.4",
"v0.7.6",
"v0.8.0",
"v0.8.1",
"v0.8.2",
"v0.9.0",
"v0.9.1",
"v0.9.2",
"v0.9.3",
"v21.04",
"v21.04.1",
"v21.04.2",
"v21.04.3",
"v21.04.4",
"v21.04.5",
"v21.04.6",
"v21.05",
"v21.05.1",
"v21.05.2",
"v21.05.3",
"v21.05.4",
"v21.08",
"v21.08.1",
"v21.08.2",
"v21.08.3",
"v21.08.4",
"v21.08.5",
"v21.08.6",
"v21.10",
"v21.10.1",
"v21.10.2",
"v21.10.3",
"v21.11",
"v21.11.1",
"v21.11.2"
]
}References
- https://nvd.nist.gov/vuln/detail/CVE-2021-4119
- https://github.com/bookstackapp/bookstack/commit/e765e618547c92f4e0b46caca6fb91f0174efd99
- https://github.com/BookStackApp/BookStack/releases/tag/v21.11.3
- https://github.com/bookstackapp/bookstack
- https://huntr.dev/bounties/135f2d7d-ab0b-4351-99b9-889efac46fca