YesWiki 存在经过身份验证的任意文件删除漏洞

攻击者可以利用此漏洞删除 YesWiki 网站上的任何文件，只要他们已通过身份验证。这可能导致网站内容丢失、网站被篡改，甚至可能导致服务器上的其他文件被删除，具体取决于 FPM 进程的权限。由于攻击者只需要身份验证即可利用此漏洞，因此攻击面相对较广。如果攻击者能够删除关键配置文件，则可能导致服务中断或进一步的系统损害。此漏洞的潜在影响包括网站数据丢失、网站可用性降低以及潜在的安全风险。

Organizations using YesWiki, particularly those with containerized deployments or shared hosting environments, are at risk. Legacy configurations with weak authentication or overly permissive file permissions are especially vulnerable. Users relying on YesWiki for critical documentation or knowledge management should prioritize patching.

• php: Examine web server access logs for requests to the filemanager endpoint with suspicious parameters that could indicate file deletion attempts. Look for patterns like ?file=../../../../etc/passwd.

grep -i 'file=../../' /var/log/apache2/access.log

• linux / server: Monitor FPM user processes for unexpected file activity. Use lsof to identify which processes have open files that are being deleted.

lsof -u www-data | grep deleted

• generic web: Check response headers for unusual content types or error messages after attempting to access or delete files through the filemanager. Look for 403 Forbidden errors or unexpected file listings.

1. 2025-01-21Disclosure

   disclosure

1. 已保留2025-01-16
2. 发布日期2025-01-21
3. 修改日期2025-02-12
4. EPSS 更新日期2026-04-02

最有效的缓解措施是立即将 YesWiki 升级到 4.5.0 或更高版本。如果无法立即升级，可以考虑限制文件管理器的访问权限，只允许访问特定目录。此外，应审查 FPM 进程的权限，确保其只具有执行必要任务所需的最低权限。实施 Web 应用防火墙 (WAF) 规则，以检测和阻止对文件管理器的恶意请求，可以提供额外的保护层。监控 YesWiki 日志，查找任何异常的文件删除活动。