Vikunja is an open-source self-hosted task management platform. From 0.21.0 until 2.4.0, the project duplication operation in pkg/models/project_duplicate.go allows an authenticated user who can read a source project to place its duplicate beneath an arbitrary target parent project. ProjectDuplicate.CanCreate calls parent.CanCreate on an unhydrated Project containing only the body supplied parent_project_id instead of calling parent.CanWrite, so the target parent write-permission check is skipped. The ordinary project creation path enforces that permission, but PUT /api/v1/projects/{project}/duplicate does not, allowing attacker-owned content to be injected into another user or team project hierarchy.
This issue is fixed in version 2.4.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
Low
Partial data modification
Availability
None
No disruption
CVSS Vector v4.0
Weakness Type (CWE)
References 4
https://github.com/go-vikunja/vikunja/commit/d911caaa11c748c3abc6b98b3189afea26…
security-advisories@github.com
https://github.com/go-vikunja/vikunja/pull/3239
security-advisories@github.com
https://github.com/go-vikunja/vikunja/releases/tag/v2.4.0
security-advisories@github.com
https://github.com/go-vikunja/vikunja/security/advisories/GHSA-f27p-pw2p-9pr4
security-advisories@github.com