CyberRota Analysis
AI-GeneratedBunkerWeb versions 1.6.2 to 1.6.12 have a vulnerability that allows low-privilege users to bypass authorization and delete critical job cache files via the /cache/ URL prefix. This could lead to the loss of important configuration data, including security lists and settings, potentially compromising the integrity of the web application firewall. Organizations using affected versions should prioritize updating to version 1.6.12 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization bypass list included the /cache/ URL prefix, so routes in src/ui/app/routes/cache.py protected only by @login_required, including POST /cache/delete, allowed low-privilege read-only reader accounts to permanently delete job cache files containing blacklist, greylist, DNSBL, CrowdSec, GeoIP, ModSecurity CRS, Let's Encrypt, ACME, and custom configuration data. This issue is fixed in version 1.6.12.