CVE-2023-46743 : Security Advisory and Response

This article provides detailed information about CVE-2023-46743, focusing on the impact, technical details, and mitigation strategies.

Understanding CVE-2023-46743

CVE-2023-46743 highlights an issue where the same file cannot be opened with different rights, affecting xwikisas' application-collabora.

What is CVE-2023-46743?

The vulnerability in application-collabora allows unauthorized preservation of editing rights for document attachment files opened in edit mode.

The Impact of CVE-2023-46743

The vulnerability poses a high risk, impacting confidentiality, integrity, and availability, with a base score of 7.4 (High Severity).

Technical Details of CVE-2023-46743

The issue stems from a caching problem in Collabora Online, specifically with the

userCanWrite

query parameter, affecting application-collabora.

Vulnerability Description

application-collabora users opening an attachment file in edit mode may unknowingly preserve editing rights for all future users, compromising access control.

Affected Systems and Versions

Vendor: xwikisas
Product: application-collabora
Affected Version: < 1.3

Exploitation Mechanism

The vulnerability arises due to a persistence of the editing session's permissions in the Collabora server caching mechanism.

Mitigation and Prevention

Given the severity of CVE-2023-46743, immediate steps should be taken to address the issue and ensure long-term security.

Immediate Steps to Take

Upgrade to version 1.3 of application-collabora to apply the necessary patch.
Review and adjust user permissions to prevent unauthorized access to editing rights.

Long-Term Security Practices

Implement regular security audits and testing to identify and mitigate similar access control issues.

Patching and Updates

Stay informed about security advisories and apply patches promptly to address known vulnerabilities.