BookStack v26.05.3
Changed 3
- Updated user external authentication ID queries and database column collation to ensure exact match
- Updated PHP package versions
- Updated translations with the latest Crowdin changes
Fixed 1
- Fixed image delete API endpoint to avoid an error scenario
Security 5
- Fixed external authentication (OIDC/SAML2/LDAP) user mismatch on login caused by case-insensitive or accented character differences in unique IDs
- Added fake hash and random delay on failed login to prevent timing-based user existence enumeration
- Updated allow list content filter to force the use of schemes and prevent interactive content from loading over file links in exports
- Updated API exception handler to follow a more controlled error message approach and prevent exposure of debug details
- Updated allow list content filter with smarter srcset attribute parsing to prevent file access beyond intended scope in PDF rendering
Security Release
This is a security release to address a range of vulnerabilities:
- External Authentication Use (OIDC/SAML2/LDAP) could potentially mismatch external authentication system users to BookStack users upon login, where unique IDs are very similar (same ID text but different casing, or accented characters).
- The login form could be abused to use timing to gain information about if a user exists in the system. This was already limited by request rate-limits, but could still have assisted targeted scenarios.
- Certain editor content could be used to load interactive content over file links when exported, which could then pose a risk after being exported in Windows environments which use NTLM.
- API errors could include debug details by default, and therefore potentially expose some system details like file paths.
- With our default PDF rendering option, certain content could be used to access/check for files on the BookStack host beyond the scope of what we'd expect.
Upgrading is generally advised, but more so for instances using OIDC, SAML2 or LDAP authentication.
Thanks to Tanner Marks (GitHub), Gurmandeep Deol (LinkedIn) and whale120 (Blog, X, Working with DEVCORE Internship Program) for responsibly reporting issues addressed in this release.
Full List of Changes
- Updated PHP package versions.
- Updated translations with the latest Crowdin changes.
- Updated login with fake hash and random delay on failed login.
- Updated allow list content filter to force the use of schemes.
- Updated allow list content filter with smarter srcset attribute parsing.
- Updated user external authentication ID queries, and database column collation, to ensure an exact match.
- Updated API exception handler to follow a more controlled error message approach.
- Fixed image delete API endpoint to avoid an error scenario.