Frappe vulnerabilities

Frappe, a full-stack web application framework, is vulnerable to path traversal attacks in versions 14.99.5 and below, and 15.0.0 through 15.80.1. Lack of proper sanitization on some requests allows arbitrary files to be retrieved from the server. This issue is fixed in versions 14.99.6 and 15.88.1.

In Frappe versions up to 7.1.27, there is an SQL injection vulnerability in the frappe.share.get_users function that allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.

Frappe prior to versions 16.14.0 and 15.104.0 has a vulnerability allowing unrestricted Doctype access via API exploit.

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Frappe 15.11.0 through 16.32.0 stores and renders workspace card descriptions without XSS filtering. The description field is marked with ignore_xss_filter, and _sanitize_content() skips such fields, so the value is stored as submitted. It is then interpolated into a Bootstrap popover with html: true, allowing a user with the Workspace Manager role to execute arbitrary markup in the sessions of other desk users.

Frappe is a full-stack web application framework. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes they are not authorized to access. When a document references another via a Link field, the framework does not consistently enforce the linked DocType's permissions, so a low-privileged user can obtain fields from linked records outside their scope. Fixed in 15.115.0.

Frappe prior to 15.115.0 and 16.27.0 has a vulnerability in the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py that return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users.

Frappe before versions 15.114.0 and 16.26.0 has a vulnerability in the OAuth2 consent flow that allows an attacker to cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client. This is due to missing POST restriction, missing CSRF token, and lack of client scoping for active OAuth tokens.

Frappe version 16.31.0 and earlier has a vulnerability where the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

Frappe version 16.31.0 and earlier has a type confusion vulnerability in frappe.client.set_value, which checks a dictionary supplied via the fieldname parameter against forbidden fields before parsing it into individual field names. An authenticated caller can exploit this to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

Frappe version 16.31.0 and earlier has a vulnerability in the whitelisted toggle_like and mark_as_seen endpoints that do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata.

Frappe is a full-stack web application framework. Prior to versions 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email.

In the Frappe framework before versions 16.20.0 and 15.112.0, an authenticated user can gain unrestricted access to the Document Follow API (update_follow).

Frappe is a full-stack web application framework. Prior to versions 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

Frappe prior to versions 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization.

Frappe prior to versions 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link.

Prior to version 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

In Frappe framework prior to versions 16.16.0 and 15.106.0, the reset_password endpoint allowed user enumeration. An attacker could verify if a given email address exists in the system.

In the Frappe framework prior to versions 16.23.0 and 15.112.0, a TarSlip RCE vulnerability was found in Package Import. Insufficient validation of tarfile members before extraction allowed remote code execution.

In Frappe prior to version 16.19.0, an authorization bypass vulnerability was found in the update_page endpoint in Workspace. Public workspaces did not undergo the required Workspace Manager edit check.

In Frappe framework prior to versions 16.20.0 and 15.110.0, users without write access could attach files to any doctype via file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

In the Frappe framework prior to versions 15.107.5 and 16.18.2, an endpoint in reportview lacked proper permission checks. This vulnerability has been fixed in the mentioned versions.

Frappe framework prior to versions 16.18.3 and 15.108.0 had a vulnerability in the check_safe_sql_query function that allowed SELECT INTO OUTFILE queries. This could be exploited on self-hosted sites if database permissions are misconfigured and MySQL FILE privileges are available.

A path traversal vulnerability in the Frappe framework allows unauthorized access to backup files via the download_backups function. The issue exists in versions prior to 16.19.0 and 15.109.0 due to insufficient path hardening.

In Frappe framework prior to version 16.18.3, a path traversal and local file inclusion vulnerability was possible through secure local resource access in the Chrome PDF Generator.

An arbitrary file read vulnerability via path traversal has been identified in Frappe framework before versions 15.105.0 and 16.15.0. The vulnerability allows an attacker to read files outside the allowed directory.

Frappe, a full-stack web application framework, versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter vulnerable to error-based SQL Injection due to lack of validation. Sensitive information such as versioning can be retrieved. Fixed in versions 14.96.10 and 15.72.0.