Skip to content

Commit 8b5fa9d

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3ccg-x393-96v8 GHSA-4qgr-4h56-8895
1 parent 271b7ac commit 8b5fa9d

2 files changed

Lines changed: 133 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/02/GHSA-3ccg-x393-96v8/GHSA-3ccg-x393-96v8.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3ccg-x393-96v8",
4+
"modified": "2026-02-25T22:02:37Z",
5+
"published": "2026-02-25T22:02:37Z",
6+
"aliases": [
7+
"CVE-2026-27575"
8+
],
9+
"summary": "Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change",
10+
"details": "**Summary**\nThe application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain valid after a user changes their password.\n\nAn attacker who compromises an account (via brute-force or credential stuffing) can maintain persistent access even after the victim resets their password.\n\n\n**Details**\n\n1. Weak passwords are accepted during registration and password change.\n2. No minimum length or strength validation is enforced.\n3. After changing the password, previously issued session tokens remain valid.\n4. No forced logout occurs across active sessions.\n\n_Attack scenario:_\n\nAttacker guesses or obtains weak credentials.\nLogs in and obtains active session token.\nVictim changes password.\nAttacker continues accessing the account using the old session.\n\n**Steps to Reproduce**\n\n**1.** Register using a weak password (e.g., 12345678 ).\n**2.** Log in and Password Change functionality.\n**3.** Change account password with single character (e.g., 1 or a )\n**4.** Reuse the old session.\n**5.** Observe that access is still granted.\n\n**Impact**\n\n- Persistent account takeover\n- Unauthorized access to sensitive data\n- Increased brute-force success probability\n- Elevated risk for administrative accounts\n\nThe combination of weak password controls and improper session invalidation significantly increases both exploitability and impact.\n\n**Recommendation**\n_**Password Policy Improvements:**_\n\n- Enforce strong password policies – Require passwords to be 8–16+ characters with a mix of uppercase, lowercase, numbers, and special characters.\n- Block common passwords – Use a blacklist of commonly used and breached passwords.\n- Use secure hashing – Store passwords using strong salted hashing algorithms like bcrypt or Argon2.\n- Enable account lockout – Limit failed login attempts to reduce brute-force risk.\n- Educate users – Promote strong password practices and phishing awareness.\n\n_**Session Management Fix:**_\n\n- Invalidate all active sessions upon password change\n- Revoke refresh tokens (if applicable)\n- Implement token/session versioning\n- Regenerate session IDs after credential updates\n- Log and notify users of password change events\n\nImplementing both controls will significantly reduce the risk of persistent account compromise.\n\n<img width=\"1918\" height=\"907\" alt=\"Weak Password Policy Combined with Persistent Sessions After Password Change POC\" src=\"https://github.com/user-attachments/assets/f188b69b-0472-4d2c-aeda-c145384c99ef\" />\n\nA fixed version is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.0.0.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.vikunja.io/api"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.24.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-3ccg-x393-96v8"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/go-vikunja/vikunja/commit/89c17d3b23e2a23320ad135b4e8f0a14fdd91bda"
46+
},
47+
{
48+
"type": "PACKAGE",
49+
"url": "https://github.com/go-vikunja/vikunja"
50+
}
51+
],
52+
"database_specific": {
53+
"cwe_ids": [
54+
"CWE-521",
55+
"CWE-613"
56+
],
57+
"severity": "CRITICAL",
58+
"github_reviewed": true,
59+
"github_reviewed_at": "2026-02-25T22:02:37Z",
60+
"nvd_published_at": null
61+
}
62+
}

‎advisories/github-reviewed/2026/02/GHSA-4qgr-4h56-8895/GHSA-4qgr-4h56-8895.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-4qgr-4h56-8895",
4+
"modified": "2026-02-25T22:01:25Z",
5+
"published": "2026-02-25T22:01:25Z",
6+
"aliases": [
7+
"CVE-2026-27116"
8+
],
9+
"summary": "Vikunja has Reflected HTML Injection via filter Parameter in its Projects Module",
10+
"details": "## Summary\n\n[Vikunja](https://github.com/go-vikunja/vikunja) is an open-source self-hosted task management platform with 3,300+ GitHub stars. A reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks \"Filter.\" While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin.\n\n**Attack flow:** Attacker shares a crafted project filter link (routine Vikunja workflow) → victim opens it → victim clicks \"Filter\" (standard UI action) → phishing content renders inside trusted Vikunja interface.\n\n## Affected Component\n\n| Field | Detail |\n|---|---|\n| Application | Vikunja v1.1.0 |\n| Module | Projects |\n| Endpoint | `/projects/-1/-1?filter=PAYLOAD&page=1` |\n| Parameter | `filter` (GET) |\n| Trigger | Click \"Filter\" button |\n| Stack | Go backend, Vue.js + TypeScript frontend |\n| Blocked | `<script>`, `<iframe>` |\n| Allowed | `<svg>`, `<a>`, `<rect>`, `<text>`, `<h1>`, `<b>`, `<u>` |\n\n## Proof-of-Concept\n\n### PoC-1: SVG Phishing Button (Highest Impact)\n\nRenders a styled, clickable red button redirecting to attacker domain. Visually indistinguishable from a real UI button.\n\n```\nhttp://localhost:3456/projects/-1/-1?filter=%3Csvg%20width%3D%22400%22%20height%3D%2260%22%3E%3Ca%20href%3D%22https%3A%2F%2Fattacker.example.com%2Flogin%22%3E%3Crect%20width%3D%22400%22%20height%3D%2260%22%20rx%3D%224%22%20fill%3D%22%23d32f2f%22%3E%3C%2Frect%3E%3Ctext%20x%3D%22200%22%20y%3D%2237%22%20text-anchor%3D%22middle%22%20fill%3D%22white%22%20font-size%3D%2216%22%3ESession%20Expired%20-%20Click%20to%20Re-authenticate%3C%2Ftext%3E%3C%2Fa%3E%3C%2Fsvg%3E&page=1\n```\n\nRaw payload:\n```html\n<svg width=\"400\" height=\"60\"><a href=\"https://attacker.example.com/login\"><rect width=\"400\" height=\"60\" rx=\"4\" fill=\"#d32f2f\"></rect><text x=\"200\" y=\"37\" text-anchor=\"middle\" fill=\"white\" font-size=\"16\">Session Expired - Click to Re-authenticate</text></a></svg>\n```\n\n### PoC-2: Phishing Link via Heading + Anchor\n\nProminent clickable link styled as urgent system message.\n\n```\nhttp://localhost:3456/projects/-1/-1?filter=%3Ch1%3E%3Ca%20href%3D%22https%3A%2F%2Fattacker.example.com%2Flogin%22%3E%E2%9A%A0%20Your%20session%20has%20expired.%20Click%20here%20to%20sign%20in%20again.%3C%2Fa%3E%3C%2Fh1%3E&page=1\n```\n\nRaw payload:\n```html\n<h1><a href=\"https://attacker.example.com/login\">⚠ Your session has expired. Click here to sign in again.</a></h1>\n```\n\n### PoC-3: Content Spoofing — Fake Security Alert\n\nFake security warning directing victim to attacker-controlled contact.\n\n```\nhttp://localhost:3456/projects/-1/-1?filter=%3Ch1%3E%3Cu%3E%3Cb%3E%E2%9A%A0%20SECURITY%20ALERT%3C%2Fb%3E%3C%2Fu%3E%3C%2Fh1%3E%3Cb%3EUnauthorized%20access%20detected%20on%20your%20account.%20Your%20account%20will%20be%20suspended%20in%2024%20hours.%20Contact%20IT%20security%20immediately%20at%20security%40attacker.example.com%20or%20visit%20https%3A%2F%2Fattacker.example.com%2Fverify%20to%20confirm%20your%20identity.%3C%2Fb%3E&page=1\n```\n\nRaw payload:\n```html\n<h1><u><b>⚠ SECURITY ALERT</b></u></h1><b>Unauthorized access detected on your account. Your account will be suspended in 24 hours. Contact IT security immediately at security@attacker.example.com or visit https://attacker.example.com/verify to confirm your identity.</b>\n```\n\n## Root Cause\n\nThe `filter` parameter is inserted into the DOM as raw HTML — likely via Vue.js `v-html` or `innerHTML`. A partial denylist strips `<script>` and `<iframe>` but does not encode output or filter SVG/anchor/formatting elements. No allowlist, no output encoding, no input syntax validation exists.\n\n## Impact\n\n| Impact | Description |\n|---|---|\n| SVG Phishing Buttons | Pixel-perfect fake buttons redirect to credential harvesting pages |\n| External Redirect | Anchor tags point to attacker domains from within trusted origin |\n| Content Spoofing | Fake alerts manipulate users into contacting attacker channels |\n| Self-Hosted Risk | Compromised credentials may grant access to internal infrastructure |\n| API Access | Same credentials grant full REST API access for data exfiltration |\n| No Logging | GET-based reflected injection leaves no distinguishable server logs |\n\n**Not Self-XSS:** Payload is attacker-controlled via URL, delivered through routine link sharing, triggered by standard UI interaction. Victim performs no security-relevant decision.\n\n## CWE & CVSS\n\n**CWE-79** (Primary) — Improper Neutralization of Input During Web Page Generation\n\n**CWE-80** (Secondary) — Improper Neutralization of Script-Related HTML Tags\n\n**CVSS 3.1:** `AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N` — **6.1 (Medium)**\n\nScore understates risk because: user interactions are routine workflow (not security decisions), SVG enables pixel-perfect UI spoofing, self-hosted deployments expose internal infrastructure, and API credential equivalence enables automated data exfiltration.\n\n## Remediation\n\n| Priority | Action |\n|---|---|\n| P0 | Replace `v-html` with `v-text` or `{{ }}` interpolation (auto-escapes HTML) |\n| P0 | HTML entity encode the `filter` value at rendering point |\n| P1 | Replace denylist with DOMPurify strict allowlist or eliminate HTML rendering of filter values |\n| P1 | Deploy CSP with `form-action 'self'` |\n| P2 | Server-side input validation — reject filter values not matching expected syntax |\n\n## References\n\n- Vikunja Repository: https://github.com/go-vikunja/vikunja\n- CWE-79: https://cwe.mitre.org/data/definitions/79.html\n- CWE-80: https://cwe.mitre.org/data/definitions/80.html\n- OWASP XSS Prevention: https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Scripting_Prevention_Cheat_Sheet.html\n\n## Conclusion\n\nThe `filter` parameter in Vikunja's Projects module renders unsanitized HTML into the DOM, enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. The attack requires only routine workflow actions — opening a shared link and clicking \"Filter.\" The fix is a single-line change: replacing `v-html` with `v-text` in the Vue.js rendering logic. Given Vikunja's adoption (3,300+ stars), self-hosted deployment model, and API credential equivalence, this warrants prompt remediation.\n\n<img width=\"1920\" height=\"1020\" alt=\"image\" src=\"https://github.com/user-attachments/assets/007f9b1a-fd20-4fe8-84e5-1bf886a5a7a9\" />\n\nA fix is available at https://github.com/go-vikunja/vikunja/releases/tag/v2.0.0.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.vikunja.io/api"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "0.24.6"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-4qgr-4h56-8895"
42+
},
43+
{
44+
"type": "WEB",
45+
"url": "https://github.com/go-vikunja/vikunja/commit/a42b4f37bde58596a3b69482cd5a67641a94f62d"
46+
},
47+
{
48+
"type": "WEB",
49+
"url": "https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Scripting_Prevention_Cheat_Sheet.html"
50+
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/go-vikunja/vikunja"
54+
},
55+
{
56+
"type": "WEB",
57+
"url": "https://github.com/go-vikunja/vikunja/releases/tag/v2.0.0"
58+
}
59+
],
60+
"database_specific": {
61+
"cwe_ids": [
62+
"CWE-116",
63+
"CWE-79",
64+
"CWE-80"
65+
],
66+
"severity": "MODERATE",
67+
"github_reviewed": true,
68+
"github_reviewed_at": "2026-02-25T22:01:25Z",
69+
"nvd_published_at": null
70+
}
71+
}

0 commit comments

Comments
 (0)