Frappe vulnerabilities

Frappe is a full-stack web application framework. Prior to 15.116.0 and 16.29.0, the OAuth login flow uses an unsanitized client-controlled state parameter to select post-authentication navigation, allowing a crafted state value to redirect a user to an attacker-chosen location. This issue is fixed in versions 15.116.0 and 16.29.0.

Frappe is a full-stack web application framework. Prior to 16.23.0, the get_count() method in reportview composes a count operation around generated SQL through a raw database execution path, allowing crafted report input to alter SQL executed by the application.

Frappe, a full-stack web application framework, is vulnerable to path traversal attacks in versions 14.99.5 and below, and 15.0.0 through 15.80.1. Lack of proper sanitization on some requests allows arbitrary files to be retrieved from the server. This issue is fixed in versions 14.99.6 and 15.88.1.

In Frappe versions up to 7.1.27, there is an SQL injection vulnerability in the frappe.share.get_users function that allows remote authenticated users to execute arbitrary SQL commands via the fields parameter.

Frappe prior to versions 16.14.0 and 15.104.0 has a vulnerability allowing unrestricted Doctype access via API exploit.

Frappe is a full-stack web application framework. Prior to versions 14.99.6 and 15.88.1, an authenticated user with specific permissions could be tricked into accessing a specially crafted link. This could lead to a malicious template being executed on the server, resulting in remote code execution. Versions 14.99.6 and 15.88.1 fix the issue. No known workarounds are available.

Frappe before 15.118.0 and 16.x before 16.31.0 contains a stored cross-site scripting vulnerability in dashboard chart filters because jQuery renders entered filter values as rich text. Authenticated attackers can store malicious filter values that execute scripts in the browsers of users who view the dashboard chart.

Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify records beyond what their assigned role permits.

Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using them in LDAP queries. Attackers can supply crafted LDAP filter syntax through these parameters to alter the resulting directory queries.

Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without proper neutralization. Authenticated attackers can set a crafted user name that executes arbitrary JavaScript in the browsers of other users who view the leaderboard.

Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session.

Frappe before 14.81.4 and 15.x before 15.41.0 contains an improper privilege management vulnerability involving a certain document action that permits escalation from the Website User role to System Manager. Authenticated attackers with Website User access can combine this document action with additional steps to obtain administrative System Manager privileges in the Frappe application.

Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest user to create and edit any Email Template. Attackers with low-privileged accounts, including self-registered users when signup is enabled, can modify Email Templates used by the application.

Frappe framework before 13.32.0 uses weak authentication for print view access, because the print view key can be derived from data exposed by other whitelisted API endpoints. Attackers can generate a valid key to view documents through the print view without proper permissions.

Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check. Attackers can invoke the document rename functionality on documents they lack permission to modify, altering records without proper authorization.

Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content.

Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting.

Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured in tracebacks. Attackers who can read error logs can extract plaintext secrets such as credentials or keys exposed in traceback local variables.

Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution when one server script triggers another. Authenticated high-privileged users can craft a Server Script that triggers other server scripts, such as by saving a document, so the remaining code runs without safe execution protections.

Frappe before 14.49.0 allows an XSS attack that is associated with blog pages and exception pages.

Frappe 15.11.0 through 16.32.0 stores and renders workspace card descriptions without XSS filtering. The description field is marked with ignore_xss_filter, and _sanitize_content() skips such fields, so the value is stored as submitted. It is then interpolated into a Bootstrap popover with html: true, allowing a user with the Workspace Manager role to execute arbitrary markup in the sessions of other desk users.

Frappe is a full-stack web application framework. Prior to version 15.115.0, an access control bypass in the REST API allows a user to read data from Linked DocTypes they are not authorized to access. When a document references another via a Link field, the framework does not consistently enforce the linked DocType's permissions, so a low-privileged user can obtain fields from linked records outside their scope. Fixed in 15.115.0.

Frappe prior to 15.115.0 and 16.27.0 has a vulnerability in the public request-data web form and PersonalDataDownloadRequest class in frappe/website/doctype/personal_data_download_request/personal_data_download_request.py that return distinguishable response shapes for registered and unregistered email addresses, including the user_name field and persistence behavior. A remote attacker can compare the responses to enumerate registered users.

Frappe before versions 15.114.0 and 16.26.0 has a vulnerability in the OAuth2 consent flow that allows an attacker to cause an authenticated user to approve an OAuth grant or reuse authorization state for the wrong client. This is due to missing POST restriction, missing CSRF token, and lack of client scoping for active OAuth tokens.

Frappe version 16.31.0 and earlier has a vulnerability where the whitelisted frappe.model.workflow.bulk_workflow_approval endpoint in frappe/model/workflow.py accepts safe HTTP methods for state-changing workflow approvals because the endpoint is not restricted to POST. An attacker can induce an authenticated victim browser to submit an approval action with the victim privileges. No released fixed version is available as of this review.

Frappe version 16.31.0 and earlier has a type confusion vulnerability in frappe.client.set_value, which checks a dictionary supplied via the fieldname parameter against forbidden fields before parsing it into individual field names. An authenticated caller can exploit this to mass-assign protected fields through the client endpoint. No released fixed version is available as of this review.

Frappe version 16.31.0 and earlier has a vulnerability in the whitelisted toggle_like and mark_as_seen endpoints that do not enforce read permission before modifying _liked_by metadata or a Note seen state. An authenticated user can interact with documents or notes that the user cannot read, disclosing resource existence and modifying resource-associated metadata.

Frappe is a full-stack web application framework. Prior to versions 16.23.0 and 15.112.0, Document Follow notification generation does not re-evaluate the recipient's current document permissions, allowing users whose access was revoked or reduced to continue receiving document data by email.

In the Frappe framework before versions 16.20.0 and 15.112.0, an authenticated user can gain unrestricted access to the Document Follow API (update_follow).

Frappe is a full-stack web application framework. Prior to versions 16.20.0 and 15.112.0, a field-level permissions bypass exposes restricted DocType fields. This issue is fixed in versions 16.23.0 and 15.112.0.

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

Frappe prior to versions 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents without the required authorization.

Frappe prior to versions 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token when a recipient follows the link.

Prior to version 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

In Frappe framework prior to versions 16.16.0 and 15.106.0, the reset_password endpoint allowed user enumeration. An attacker could verify if a given email address exists in the system.

In the Frappe framework prior to versions 16.23.0 and 15.112.0, a TarSlip RCE vulnerability was found in Package Import. Insufficient validation of tarfile members before extraction allowed remote code execution.

In Frappe prior to version 16.19.0, an authorization bypass vulnerability was found in the update_page endpoint in Workspace. Public workspaces did not undergo the required Workspace Manager edit check.

In Frappe framework prior to versions 16.20.0 and 15.110.0, users without write access could attach files to any doctype via file-handling API endpoints such as add_attachments. This issue is fixed in versions 16.20.0 and 15.110.0.

In the Frappe framework prior to versions 15.107.5 and 16.18.2, an endpoint in reportview lacked proper permission checks. This vulnerability has been fixed in the mentioned versions.

Frappe framework prior to versions 16.18.3 and 15.108.0 had a vulnerability in the check_safe_sql_query function that allowed SELECT INTO OUTFILE queries. This could be exploited on self-hosted sites if database permissions are misconfigured and MySQL FILE privileges are available.

A path traversal vulnerability in the Frappe framework allows unauthorized access to backup files via the download_backups function. The issue exists in versions prior to 16.19.0 and 15.109.0 due to insufficient path hardening.

In Frappe framework prior to version 16.18.3, a path traversal and local file inclusion vulnerability was possible through secure local resource access in the Chrome PDF Generator.

An arbitrary file read vulnerability via path traversal has been identified in Frappe framework before versions 15.105.0 and 16.15.0. The vulnerability allows an attacker to read files outside the allowed directory.

Frappe, a full-stack web application framework, versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter vulnerable to error-based SQL Injection due to lack of validation. Sensitive information such as versioning can be retrieved. Fixed in versions 14.96.10 and 15.72.0.