{"schema":"threatline.record/2","record":{"id":"GHSA-x9j5-r988-9jcc","aliases":["GHSA-x9j5-r988-9jcc"],"summary":"Unauthenticated Server-Side Request Forgery with response read-back via the [[|URL]] raw-inclusion syntax","details":"### Summary\r\n\r\nAn unauthenticated Server-Side Request Forgery (SSRF) vulnerability allows any\r\nunauthenticated visitor to make the YesWiki server issue HTTP(S) requests to\r\narbitrary hosts and ports — including internal/loopback addresses — and read the\r\nresponse body back in the HTTP reply. This is a **new sink** of the same\r\nunauthenticated-SSRF class already fixed for `{{syndication}}` (GHSA-jwh5-j4f4-c6xp)\r\nand `{{valeur}}` (GHSA-pghp-rrp4-q666): the shared `render` gateway is still\r\nungated, and the `[[|URL]]` raw-inclusion sink was not covered by those fixes.\r\nConfirmed live on current HEAD `4ca3fb7` (2026-09-23).\r\n\r\n### Details\r\n\r\nThe wakka \"raw inclusion from another wiki\" syntax `[[|URL]]` fetches an\r\nattacker-controlled URL server-side with **no scheme/host/IP validation** and\r\nechoes the response line by line:\r\n\r\n- `formatters/wakka.php:310-323` — builds `$url` from user input, then\r\n  `return $wiki->Format($wiki->Format($url, 'raw'), 'wakka');`\r\n- `formatters/raw.php:3` — `if ($lines = file($text)) { foreach ($lines as $line) { echo $line; } }`\r\n  (`allow_url_fopen` is On by default; `file()` supports http/https/ftp).\r\n\r\nIt is reachable **unauthenticated** through the generic page-render handler, which\r\nformats attacker-supplied `$_GET['content']` for any visitor with no ACL check —\r\nthe *same* pre-auth gateway as the two prior SSRF advisories:\r\n\r\n- `handlers/page/render.php:7-9` —\r\n  `$this->page['body'] = strip_tags($_GET['content']); $output .= $this->Format($this->page['body']);`\r\n- `strip_tags()` removes HTML but **not** wiki syntax, so `[[|URL]]` survives.\r\n- `YesWiki::Run()` (`includes/YesWiki.php:1235-1266`) dispatches handlers with no\r\n  central read-ACL gate.\r\n\r\nThe same sink is also reachable **stored**: a registered editor\r\n(`POST /api/pages/{tag}`, ACL `+`, `includes/controllers/ApiController.php:572`)\r\nsaves a page body containing `[[|URL]]`, which fires when any anonymous visitor\r\nviews it (`handlers/page/show.php:65`).\r\n\r\n### PoC\r\n\r\nDefault installation, no configuration changes. Stand up any HTTP service on an\r\ninternal host the client cannot reach directly (models an internal service), then\r\nsend — with no cookie or authentication:\r\n\r\n```\r\nGET /?wiki=PagePrincipale/render&content=[[|http://INTERNAL_HOST:PORT/x]]\r\n```\r\n\r\n- The YesWiki server issues `GET /x/wakka.php?wiki=404/raw` to `INTERNAL_HOST:PORT`\r\n  (visible in the target's access log, sourced from the YesWiki container).\r\n- `INTERNAL_HOST`'s response body is reflected back in the HTTP response — full\r\n  read-back SSRF. Blind reachability confirmed against arbitrary host:port.\r\n\r\n### Impact\r\n\r\nUnauthenticated attackers can reach internal services and hosts behind the\r\nserver's network boundary and read their responses.\r\n","categories":["Unclassified"],"product":"yeswiki/yeswiki","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc","source_modified_at":"2026-10-09T11:20:09Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"composer","name":"yeswiki/yeswiki"},"range":"< 4.7.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc","source_modified_at":"2026-10-09T11:20:09Z","fetched_at":"2026-10-29T00:48:09.584895Z","package":{"ecosystem":"composer","name":"yeswiki/yeswiki"},"version":"4.7.0"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-09T11:20:09Z","modified_at":"2026-10-09T11:20:09Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/YesWiki/yeswiki/security/advisories/GHSA-x9j5-r988-9jcc","fetched_at":"2026-10-29T00:48:09.584895Z","source_modified_at":"2026-10-09T11:20:09Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-09T11:20:09Z","content_hash":"317f3ead80a95b30de3dd64585ec413cf218bb0ce9c66f7e258451eeee08b498"}}