Executive brief
Raneto is an open-source knowledge base and wiki platform. A vulnerability in the search functionality allows attackers to craft malicious input that causes the application to crash or become unresponsive, disrupting service for all users. An attacker can trigger this remotely without authentication or special privileges.
Technical details
The vulnerability is a denial of service flaw triggered by a malicious payload injected into the Search parameter. The root cause involves improper input validation or error handling in the search functionality (CWE-287/CWE-703 territory, indicating potential authentication/authorization or improper neutralization issues). The attack requires no authentication and is triggered over the network via HTTP. An attacker can crash the application or degrade performance severely by sending a crafted search query. The issue was fixed in version 0.17.1; versions 0.17.0 and earlier are affected.
Affected products
- Raneto Raneto 0.17.0 and earlier
Timeline
- 2022-08-05: disclosed
- 2022-08-11: patched: Fix released in version 0.17.1