Description

SPIP before 4.4.18 contains a missing authorization vulnerability in the administrative action endpoints under ecrire/action/ that allows unauthenticated attackers to perform privileged actions by supplying a valid HMAC-SHA256 nonce without any server-side permission check via autoriser(). Attackers can obtain a valid nonce, compute it for any action as the anonymous user, and invoke the editer_auteur action directly over HTTP to reset the password of any user account, including the administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T17:18:58.760Z",
  "pubdate": "2026-09-11T17:18:58.760Z",
  "executiveSummary": "A critical missing authorization vulnerability exists in SPIP versions prior to 4.4.18, residing within the administrative action endpoints located at ecrire/action/. This flaw allows unauthenticated attackers to bypass server-side security checks by leveraging a valid HMAC-SHA256 nonce.\nThe vulnerability permits unauthorized execution of privileged administrative actions. Specifically, an attacker can manipulate the editer_auteur function to perform unauthorized operations, most notably the password reset of any user account, including administrative accounts.\nThis represents a severe security risk as it grants remote, unauthenticated actors full control over the application's user base. By successfully invoking restricted actions through the action handler without triggering the necessary autoriser() permission checks, the integrity and confidentiality of the SPIP instance are completely compromised.\nThe attack requires no prior authentication or administrative privileges, significantly lowering the barrier for exploitation. Affected systems remain at high risk until the update to 4.4.18 or later is applied, as there is currently no native protection against the crafting of these HMAC-signed requests by unauthorized entities.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of authorization controls within the SPIP administrative framework, specifically affecting the dispatching mechanism for requests targeting the ecrire/action/ directory.\nIn SPIP, the action system is designed to execute specific administrative tasks. These requests are typically protected by an HMAC-SHA256 signature intended to verify the integrity and origin of the request. However, the system fails to perform a secondary, robust server-side validation using the autoriser() function—a critical security gate that confirms whether the requester possesses the required permissions to perform the requested operation.\nThe exploitation flow proceeds as follows: First, an attacker identifies the target action, such as editer_auteur, which handles user object modification. Second, the attacker acquires a valid nonce that the application accepts as legitimate for the signature calculation. Third, because the application relies on the presence of the HMAC signature rather than a strict session-based or role-based check within the destination function, the attacker computes a valid HMAC-SHA256 signature associated with the desired malicious payload. Fourth, the attacker sends a crafted HTTP request to the vulnerable endpoint with the forged signature. Since the authorization check is omitted, the application processes the command as if it were a privileged administrative request.\nBy targeting the editer_auteur function specifically, an attacker can modify user attributes. By submitting parameters to change a user's password, the attacker can effectively take over any account, including the primary administrator. This bypasses the intended security model where only authenticated sessions with sufficient privileges should be permitted to call such functions.\nThe vulnerability is exposed over the network, allowing remote exploitation of any SPIP installation that has not been updated to version 4.4.18. The lack of granular permission verification within the action dispatching logic effectively turns the administrative interface into an unauthenticated control surface, provided the attacker can generate a valid cryptographic signature recognized by the application's verification routines.\nThe impact is total application compromise. Once an administrator account is seized via the unauthorized password reset, the attacker gains full control over the SPIP CMS, facilitating further attacks such as arbitrary code execution, content modification, or data exfiltration."
}