Listen to this Post
Wagtail is an open-source content management system (CMS) built on Django. A vulnerability has been identified in the document serving mechanism of Wagtail, allowing an attacker to determine the presence of a document based on a known SHA1 hash.
The core of this vulnerability lies in the way Wagtail’s document endpoint handles specific HTTP conditional headers. The endpoint, used to serve documents, accepts `If-Match` and `If-None-Match` headers. These headers are part of the HTTP specification, designed for conditional requests, typically used for cache validation or to prevent the “lost update” problem. They work by comparing the provided ETag (Entity Tag) value with the resource’s current ETag.
In Wagtail, the ETag for a document is derived from its `file_hash` attribute, which is a SHA1 hash of the document’s file content. By making a request to the document serve URL (e.g., /documents/123/) and including an `If-Match` header with a specific SHA1 hash, the server will respond differently based on whether the hash matches the document’s actual hash.
If the hash in the `If-Match` header matches the document’s hash, the server responds with the document content (HTTP 200 OK). If it does not match, the server responds with a `412 Precondition Failed` status code. This discrepancy in HTTP response codes allows an attacker to perform a binary test: by cycling through a list of known SHA1 hashes and document IDs, they can determine which documents exist in the library with a specific hash.
Crucially, this attack does not require any permissions to view the document, nor does the attacker need to know the document’s filename. The only prerequisite is knowing the document’s ID and a SHA1 hash to test. The vulnerability does not expose the document’s content or any other metadata; it only confirms or denies the existence of a document with a given hash. This information leakage can be a stepping stone for more targeted attacks, such as confirming the presence of a known sensitive file. The vulnerability affects all Wagtail versions prior to the patched releases.
DailyCVE Form:
Platform: Wagtail CMS
Version: <7.0.9, 7.1-7.3.3, 7.4-7.4.2, 8.0rc1
Vulnerability: Information Disclosure
Severity: Low
Date: 2026-08-20
Prediction: Already Patched (2026-08-20)
What Undercode Say:
The vulnerability stems from the document endpoint’s ETag generation using the `file_hash` attribute. An attacker can enumerate document existence.
Bash commands and codes related:
Example: Testing for document existence with a known hash Replace 123 with the document ID and HASH_VALUE with the SHA1 hash curl -I -H "If-Match: \"HASH_VALUE\"" https://example.com/documents/123/ If the hash matches, the server returns HTTP 200 OK If the hash does not match, the server returns HTTP 412 Precondition Failed
Exploit: (Educational Purposes!)
- Identify Target: Choose a known document ID (e.g.,
123) from the Wagtail site. - Formulate Request: Construct a `GET` request to the document’s serve URL (
/documents/123/). - Inject Header: Add an `If-Match` header with a double-quoted SHA1 hash value (e.g.,
If-Match: "da39a3ee5e6b4b0d3255bfef95601890afd80709").
4. Analyze Response:
200 OK: The document exists and its hash matches the provided value.
412 Precondition Failed: The document exists, but its hash does not match.
404 Not Found: The document ID does not exist.
Protection:
- Upgrade Wagtail: The primary and most effective mitigation is to upgrade to a patched version: Wagtail 7.0.9, 7.3.4, 7.4.3, or 8.0rc2.
- Reverse Proxy Filtering: For those unable to upgrade immediately, strip the `If-Match` and `If-None-Match` headers from anonymous requests to the `/documents/` endpoint at the reverse proxy level.
- Custom Document Model: As a workaround, site owners can implement a custom document model that does not include a `file_hash` attribute.
Impact:
An attacker can determine whether a specific document exists in the Wagtail document library if they know its SHA1 hash. This could confirm the presence of known sensitive files, aiding in further reconnaissance. The vulnerability does not expose file contents or other metadata.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
