Description
ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify other tenants' fast commands by supplying arbitrary sequential ids to POST /manage/saveFastCommand. Attackers can overwrite another tenant's command title, type, content and robot binding, redirecting webpage-jump commands to attacker URLs and reassigning the record to their own tenant.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zhimaAi | chatwiki | < 2.10.0 | 2.10.0 |
References
- GitHub Issue #180 issue-tracking
- https://github.com/zhimaAi/chatwiki product
- Fix merge commit (PR #183) patch
- Fix commit d1ca145 patch
- chatwiki v2.10.0 Release Notes release-notes
- SaveFastCommand edit path technical-description
- Researcher write-up technical-description
- VulnCheck Advisory: ChatWiki before 2.10.0 Cross-Tenant Fast Command Modification via saveFastCommand third-party-advisory