Bunkerweb
Monthly
Privilege escalation in BunkerWeb's UI and API allows a low-privileged authenticated user to inject attacker-controlled Datalog facts into signed Biscuit authorization tokens by manipulating the HTTP Host header, which was interpolated directly into the token builder string without parameterization. Affected are BunkerWeb open-source versions prior to 1.6.12 and BunkerWeb PRO prior to 0.57. No public exploit identified at time of analysis, but the public commit diff fully documents the injection mechanism, making reproduction straightforward for any authenticated low-privileged account holder.
Improper authorization in BunkerWeb's web UI middleware allows authenticated reader-role accounts to permanently delete WAF job cache files in versions 1.6.2 through 1.6.11. The BiscuitMiddleware bypass list incorrectly included the `/cache/` URL prefix, causing the `POST /cache/delete` route to skip Biscuit role-based access control and enforce only Flask's `@login_required` decorator, making write-privileged cache operations accessible to any authenticated user. Deleted cache can include blacklists, GeoIP data, ModSecurity CRS rules, CrowdSec data, and ACME/Let's Encrypt certificate material, degrading WAF protective capability. No public exploit is identified at time of analysis; vendor-released patch is available in version 1.6.12.
Privilege escalation in BunkerWeb's UI and API allows a low-privileged authenticated user to inject attacker-controlled Datalog facts into signed Biscuit authorization tokens by manipulating the HTTP Host header, which was interpolated directly into the token builder string without parameterization. Affected are BunkerWeb open-source versions prior to 1.6.12 and BunkerWeb PRO prior to 0.57. No public exploit identified at time of analysis, but the public commit diff fully documents the injection mechanism, making reproduction straightforward for any authenticated low-privileged account holder.
Improper authorization in BunkerWeb's web UI middleware allows authenticated reader-role accounts to permanently delete WAF job cache files in versions 1.6.2 through 1.6.11. The BiscuitMiddleware bypass list incorrectly included the `/cache/` URL prefix, causing the `POST /cache/delete` route to skip Biscuit role-based access control and enforce only Flask's `@login_required` decorator, making write-privileged cache operations accessible to any authenticated user. Deleted cache can include blacklists, GeoIP data, ModSecurity CRS rules, CrowdSec data, and ACME/Let's Encrypt certificate material, degrading WAF protective capability. No public exploit is identified at time of analysis; vendor-released patch is available in version 1.6.12.