SecBoard
Zurück zur CVE-Übersicht

CVE-2026-105786

NONE
Risk Signal Score0/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.3%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in user through a generic consent page, and the public packages/server/src/routes/api/application_auth.ts endpoint passes it to ApplicationModel.createAppPassword without authenticating or binding the redeemer. An attacker can cause a victim to approve the attacker's identifier, redeem a durable application ID and password, and exchange the credential for a victim session with full read and write access to synchronized data. This vulnerability is fixed in 3.7.13.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • v3.7.13

Threat-Hunting-Queries

Detect attempts to bypass session and CSRF checks on the application authorization POST endpoint.

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessCommandLine contains "/applications/" and InitiatingProcessCommandLine contains "/confirm" and InitiatingProcessCommandLine contains "POST"
| where not (InitiatingProcessCommandLine contains "_csrf") // Simplified: Look for POST requests to the confirm endpoint without CSRF token in command line (if applicable to logging)
| project Timestamp, DeviceName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl

Splunk SPL

index=* (uri_path="/applications/*/confirm" OR uri_path="/applications/*/confirm/") method="POST" 
| where NOT _raw LIKE "*csrf*" // Simplified: Look for POST requests to the confirm endpoint without CSRF token in raw logs
| table _time, host, uri_path, method, clientip

Sigma

title: Joplin Application Authorization Bypass
status: experimental
description: Detects attempts to bypass session and CSRF checks on the Joplin application authorization POST endpoint.
logsource:
  category: webserver
  service: joplin_server
detection:
  selection:
    http_method: "POST"
    uri|contains: "/applications/"
    uri|endswith: "/confirm"
    body|!contains: "_csrf"
  condition: selection
fields:
  - http_method
  - uri
  - source_ip
  - user_agent
level: high

Elastic ES|QL

from logs-webserver-joplin.*
| where http.request.method == "POST"
| where http.request.url.path matches "/applications/*/confirm"
| where not http.request.body matches "_csrf"
| select @timestamp, host.name, http.request.method, http.request.url.path, source.ip

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen