Go Shiori
Monthly
Server-Side Request Forgery in Shiori's bookmark download function allows any authenticated user to force the server to issue HTTP requests to loopback addresses (127.0.0.1) and 0.0.0.0 - which Linux routes to the loopback interface - reaching cloud metadata endpoints, co-located databases, and internal-only APIs. The root cause is `DownloadBookmark()` in `internal/core/download.go` using a plain `http.Client` with no custom `DialContext` and no post-resolution IP validation (no `IsLoopback()`, `IsPrivate()`, `IsUnspecified()`, or `IsLinkLocalUnicast()` checks). No public exploit has been identified at time of analysis, but the attack path is trivially constructable given the well-documented SSRF pattern against Go's standard HTTP client.
Privilege persistence in Shiori, the self-hosted bookmarks manager (go-shiori/shiori), allows a deleted or demoted owner to continue authenticating with full owner-level privileges for up to 30 days after account revocation. The root cause is that CheckToken in internal/domains/auth.go validates only the JWT HMAC signature and trusts the embedded claims without re-querying the database, and no token revocation or session store mechanism exists anywhere in the codebase. An attacker who previously held an owner-level account - such as a terminated employee - retains full read/write access to all bookmarks and administrative functions until the token's natural expiry. No active exploitation confirmed (no CISA KEV listing); no public exploit code identified at time of analysis.
Vertical privilege escalation in Shiori (go-shiori), the self-hosted Go bookmark manager, lets any authenticated low-privilege user promote themselves to administrator. By sending a crafted PATCH request to the /api/v1/auth/account update endpoint with owner: true - a field that lacked an authorization check - the user flips their own owner flag, then re-authenticates to receive an admin JWT granting full system access. Disclosed by VulnCheck with a vendor fix committed upstream; no public exploit identified at time of analysis and it is not listed in CISA KEV.
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. [CVSS 6.5 MEDIUM]
Server-Side Request Forgery in Shiori's bookmark download function allows any authenticated user to force the server to issue HTTP requests to loopback addresses (127.0.0.1) and 0.0.0.0 - which Linux routes to the loopback interface - reaching cloud metadata endpoints, co-located databases, and internal-only APIs. The root cause is `DownloadBookmark()` in `internal/core/download.go` using a plain `http.Client` with no custom `DialContext` and no post-resolution IP validation (no `IsLoopback()`, `IsPrivate()`, `IsUnspecified()`, or `IsLinkLocalUnicast()` checks). No public exploit has been identified at time of analysis, but the attack path is trivially constructable given the well-documented SSRF pattern against Go's standard HTTP client.
Privilege persistence in Shiori, the self-hosted bookmarks manager (go-shiori/shiori), allows a deleted or demoted owner to continue authenticating with full owner-level privileges for up to 30 days after account revocation. The root cause is that CheckToken in internal/domains/auth.go validates only the JWT HMAC signature and trusts the embedded claims without re-querying the database, and no token revocation or session store mechanism exists anywhere in the codebase. An attacker who previously held an owner-level account - such as a terminated employee - retains full read/write access to all bookmarks and administrative functions until the token's natural expiry. No active exploitation confirmed (no CISA KEV listing); no public exploit code identified at time of analysis.
Vertical privilege escalation in Shiori (go-shiori), the self-hosted Go bookmark manager, lets any authenticated low-privilege user promote themselves to administrator. By sending a crafted PATCH request to the /api/v1/auth/account update endpoint with owner: true - a field that lacked an authorization check - the user flips their own owner flag, then re-authenticates to receive an admin JWT granting full system access. Disclosed by VulnCheck with a vendor fix committed upstream; no public exploit identified at time of analysis and it is not listed in CISA KEV.
A lack of rate limiting in the login page of shiori v1.7.4 and below allows attackers to bypass authentication via a brute force attack. [CVSS 6.5 MEDIUM]