CVE-2024-36676: BookStack DOS Vulnerability

CVE-2024-36676 Overview

CVE-2024-36676 is an incorrect access control vulnerability in BookStack, an open-source wiki and documentation platform. Versions prior to v24.05.1 expose public-facing forms that allow unauthenticated attackers to confirm whether a specific email address corresponds to an existing system user. The same forms enable targeted notification email denial-of-service (DoS) against confirmed accounts. The issue is tracked under [CWE-79] in the National Vulnerability Database, although the underlying behavior described by the maintainers is enumeration and notification abuse rather than script injection.

Critical Impact
Attackers can enumerate valid BookStack accounts through public forms and flood targeted users with notification emails, degrading mailbox availability and aiding follow-on phishing.

Affected Products

BookStack versions prior to v24.05.1
Self-hosted BookStack deployments exposing public registration or password-reset forms
BookStack instances configured to send transactional notification emails

Discovery Timeline

2024-07-09 - CVE-2024-36676 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-36676

Vulnerability Analysis

The vulnerability resides in public-facing forms that respond differently depending on whether a submitted email address belongs to a registered BookStack user. Attackers submit candidate email addresses and observe the application response, timing, or downstream email behavior to confirm account existence. Once an address is confirmed, the same forms can be invoked repeatedly to trigger notification emails directed at the victim mailbox. The result is twofold: account enumeration that supports targeted phishing or credential stuffing, and a notification email flood that consumes mailbox quota and can damage the sending domain's reputation.

Root Cause

The application did not normalize responses for public form submissions across known and unknown email addresses. It also lacked rate limiting and abuse controls on the endpoints responsible for dispatching notification email. The BookStack maintainers addressed the behavior in release v24.05.1 by tightening responses on public forms and adjusting the email dispatch path.

Attack Vector

Exploitation requires only network access to the BookStack web interface. No authentication or user interaction is needed. An attacker scripts repeated submissions of public forms with email address candidates, records the application response, and then targets confirmed addresses with high-volume notification requests. See the GitHub Issue #4993 for the maintainer's technical discussion of the affected endpoints.

No verified proof-of-concept code has been published for CVE-2024-36676. The vulnerability mechanism is documented in the upstream issue and resolved in the BookStack Blog Release v24.05.1 notes.

Detection Methods for CVE-2024-36676

Indicators of Compromise

High request volume against BookStack public endpoints such as password reset or registration forms from a single source address or rotating proxies
Sudden spike in outbound notification email from the BookStack mail relay to a small set of recipient addresses
Web server access logs showing sequential email parameter values submitted to the same public form within short time windows

Detection Strategies

Parse BookStack and reverse proxy access logs for repeated POST requests to public form endpoints with varying email parameters
Correlate web request volume with SMTP relay logs to identify enumeration-driven notification floods
Alert on responses from public forms when request rates exceed a baseline established for legitimate user activity

Monitoring Recommendations

Forward BookStack application and web server logs to a centralized SIEM or data lake for retention and correlation
Track outbound email volume per recipient and alert on deviations from historical baselines
Monitor for user reports of unexpected BookStack notification email, which often surface enumeration campaigns earlier than log analytics

How to Mitigate CVE-2024-36676

Immediate Actions Required

Upgrade BookStack to version v24.05.1 or later using the official release artifacts
Place the BookStack instance behind a reverse proxy or web application firewall that enforces rate limiting on public form endpoints
Audit recent web and SMTP logs for evidence of enumeration or notification flooding prior to upgrade

Patch Information

The maintainers fixed CVE-2024-36676 in GitHub Release v24.05.1. Administrators should apply the upgrade following standard BookStack deployment procedures, including database migration steps documented in the release notes.

Workarounds

Restrict access to BookStack public forms to trusted networks or behind single sign-on where business requirements allow
Apply per-IP and per-email rate limits at the reverse proxy layer to curb enumeration attempts
Configure outbound mail throttling on the SMTP relay used by BookStack to limit notification flood impact

bash

# Example nginx rate limit for BookStack public form endpoints
limit_req_zone $binary_remote_addr zone=bookstack_forms:10m rate=5r/m;

server {
    location ~ ^/(password/email|register) {
        limit_req zone=bookstack_forms burst=5 nodelay;
        proxy_pass http://bookstack_upstream;
    }
}