VaultWiki News

As of May 3, security patches for May 2022 are now available.

Issue List

VWE-2022-6416 is an Information Disclosure issue, where some variants of the VAR BB-Code allow any wiki editor to view and publicize the current VaultWiki version number. The issue affects VaultWiki 4.0.19 and higher. Prior to 4.0.19, Information Disclosures were not treated as security issues.

VWE-2022-6420 is an HTML Injection issue, where by leveraging a flaw in the cropping of overly-long WIKI BB-Code usages, a malicious user can modify the expected contents of HTML blocks outside the intended user-generated content locations. The issue affects VaultWiki 4.0.9 and higher, as well as earlier patches for VWE-2016-2072.

VWE-202206426 is a Denial of Service issue, where on some hosts and server configurations, VaultWiki's deferred tasks trigger a false-positive in denial-of-service protective measures, which causes some visitors to inappropriately receive temporary bans or for the hosting account to be temporarily suspended, because the web-based deferred tasks may be processed in rapid succession. The issue affects all versions of the VaultWiki 4.x series, although the issue is more pronounced on XenForo-based platforms.

Patches

The following patches address the aforementioned issues:

• 4.1.4 Patch Level 2
• 4.1.3 Patch Level 4
• 4.1.2 Patch Level 6

Notes

We highly recommend that all users running VaultWiki in a production environment update to a release as soon as they are able.

As of March 5, security patches for March 2022 are now available.

Issue List

VWE-2022-6401 is an HTML Injection issue, where a flaw in the cropping of overly-long WIKI BB-Code content may allow a malicious user to modify the expected contents of HTML blocks outside of the intended user-generated content locations. The issue affects VaultWiki 4.1.0 Beta 4 and higher.

VWE-2022-6406 is a Data Loss issue, where uploading an update to an existing wiki attachment, while attachment history is disabled, can result in an attachment with no file data. The issue affects VaultWiki 4.1.1 and higher.

VWE-2022-6411 is a Data Loss issue, where some database updates that are triggered by CLI-based cron jobs are never applied to the database. The issue affects VaultWiki 4.1.0 Alpha 1 and higher, on XenForo 2.x platforms only.

Patches

The following patches address the aforementioned issues:

• 4.1.4 Patch Level 1
• 4.1.3 Patch Level 3
• 4.1.2 Patch Level 6

Notes

Due to the potential data loss in unpatched installations, we highly recommend that all users running VaultWiki in a production environment update to a patched release as soon as practicable.

VaultWiki 4.1.4 is now available for licensed customers. This version is a maintenance release with roughly 20 bug fixes.

XenForo 2.2.8 Compatibility

VaultWiki 4.1.4 is the first release to be compatible with XenForo 2.2.8 and higher. XenForo 2.2.8 had updated the editor to a new major version of FroalaEditor (from v3 to v4). Most notably, the update required changes to the timing of VaultWiki's various Javascript plugins in order to prevent errors both in wiki and regular forum editors.

If you are already running XenForo 2.2.8 with an earlier version of VaultWiki, we strongly recommend that you update to 4.1.4 as soon as you are able in order to resolve these editor issues.

As of January 1, security patches for January 2022 are now available.

Issue List

VWE-2021-6355 is a Phishing issue, where user-positioned elements are not restricted within the relevant position's container when viewing previous page revisions. The issue affects VaultWiki 4.0.18 and higher, as well as patches for VWE-2017-3734.

VWE-2021-6363 is a Permissions Escalation issue, where a user can use a specially-crafted form submission to save more than the maximum allowed number of attachments per wiki comment. The issue affects all versions of the VaultWiki 4.x series.*

VWE-2021-6358 is a Denial of Service issue, where the entire wiki remains disabled after an administrator performs changes that trigger certain rebuild tasks. The issue affects VaultWiki 4.1.3 and higher.

VWE-2021-6359 is a Denial of Service issue, where the entire wiki remains disabled after an administrator changes the option Force URLs to Lower-Case. The issue affects all prior versions of the VaultWiki 4.1.x series.

VWE-2021-6364 is a Permissions Escalation issue, where a user can associate an attachment to comments even though permission to add attachments has been revoked since the user uploaded the attachment.*

* Please be aware that variations of these same issues also affect basic content-types on stock installations of both vBulletin and XenForo.

Additionally, some improvements have been made regarding changes from some prior 2021 patches, where certain functionality had been adversely affected by the earlier patch.

Patches

The following patches address the aforementioned issues:

• 4.1.3 Patch Level 2
• 4.1.2 Patch Level 5

Notes

We recommend that all users running VaultWiki in a production environment update to a patched release.

As of December 1, security patches for December 2021 are now available.

Issue List

VWE-2021-6267 is a Denial of Service issue, where a user can cause any page showing BB-Code content to render as a fatal error by leveraging a flaw in the WIDGET BB-Code. The issue affects all versions of the VaultWiki 4.x series.

VWE-2021-6343 is a Denial of Service issue, where a user can cause any page showing BB-Code content to render as a fatal error by leveraging a flaw in the WIDGET BB-Code's forum and thread renderers. The issue affects the VaultWiki 4.1.x series on XenForo 2.x platforms only.

VWE-2021-6347 is a Permissions Escalation issue, where a user can circumvent the maximum allowed file size for an attachment by uploading a specially-crafted image file in excess of the maximum allowed dimensions. The issue affects all versions of the VaultWiki 4.x series, but the effect is worst in VaultWiki 4.0.20 and higher, as well as patches for VWE-2017-4030.

Patches

The following patches address the aforementioned issues:

• 4.1.3 Patch Level 1
• 4.1.2 Patch Level 4
• 4.1.1 Patch Level 9*

*A patch was issued for this version even though it reached its end-of-life before the patch date, because at least one of the addressed issues was identified prior to its end-of-life. However, we recommend that users update to a more recent patched version.

Notes

We recommend that all users running VaultWiki in a production environment update to a patched release.

VaultWiki 4.1.3 is now available for licensed customers. This version is a maintenance release with roughly 150 bug fixes and style tweaks.

VaultWiki 4.1.3 adds support for wiki attachments to set the WEBP extension as an image type, if PHP has been compiled with WEBP support. In addition, if support is available, WEBP will be the preferred format for image thumbnails.

For a list of more changes in this release, please see Changelog for 4.1.3. If you are a style or language pack maintainer, please check here for changes which may affect you.