CVE-2022-23644 Server-side request forgery in BookWyrm

What is CVE-2022-23644?

CVE-2022-23644 is a high-severity server-side request forgery vulnerability in bookwyrm-social bookwyrm, published on 16 Feb 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

BookWyrm is a decentralized social network for tracking reading habits and reviewing books. The functionality to load a cover via url is vulnerable to a server-side request forgery attack. Any BookWyrm instance running a version prior to v0.3.0 is susceptible to attack from a logged-in user. The problem has been patched and administrators should upgrade to version 0.3.0 As a workaround, BookWyrm instances can close registration and limit members to trusted individuals.

Weakness: CWE-918

Which versions are affected by CVE-2022-23644?

It affects 1 product.

Products include Joinbookwyrm Bookwyrm.

How do I fix CVE-2022-23644?

No fix has been published for CVE-2022-23644 yet. Limit exposure of the affected software until one is available.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2022-23644 being exploited?

There is no known exploitation of CVE-2022-23644 in the wild and no public exploit code.

Other vulnerabilities in bookwyrm-social bookwyrm

• CVE-2022-2651 Authentication Bypass by Primary Weakness in bookwyrm-social/bookwyrm Critical 9.8
• CVE-2022-35953 URL Redirection to Untrusted Site ('Open Redirect') in bookwyrm High 7.1
• CVE-2022-31136 Cross-site Scripting in BookWyrm Medium 6.3
• CVE-2022-35925 Missing rate limit in Authentication in bookwyrm Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5m7g-66h6-5cvq.