Description
Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and handlePageContentRequest that allows unauthenticated attackers to enumerate configured page slugs. Attackers can request candidate names against /{page} or /api/pages/{page}/content/ and compare 303/401 versus 404 status codes to discover hidden page names.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glanceapp | glance | 0.8.0 – < 0.8.8 | 0.8.8 |
References
- GitHub Security Advisory (GHSA-294x-cjq2-6j5r) vendor-advisory
- https://github.com/glanceapp/glance/commit/e19081cfa029edbe16b1354ffe03076a8cdf0244 patch
- https://github.com/glanceapp/glance/blob/v0.8.7/internal/glance/glance.go#L306-L316 technical-description
- glance v0.8.8 Release Notes release-notes
- VulnCheck Advisory: Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy third-party-advisory