SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Forum/Board/Portal)  >   MoniWiki Vendors:   moinmoin.wikiwikiweb.de
MoniWiki 'UploadFile.php' Lets Remote Users Upload and Execute Scripting Code
SecurityTracker Alert ID:  1012532
SecurityTracker URL:  http://securitytracker.com/id/1012532
CVE Reference:   GENERIC-MAP-NOMATCH   (Links to External Site)
Date:  Dec 15 2004
Impact:   Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.0.9.2 and prior versions
Description:   STG Security reported an input validation vulnerability in MoniWiki in 'UploadFile.php'. A remote user can upload arbitrary files to the server and then cause the web server to execute the files.

It is reported that the 'UploadFile.php' script does not restrict the use of multiple file extensions (e.g., 'attack.php.hwp') on uploaded files. A remote user can upload a file containing arbitrary scripting code and then invoke the uploaded file to execute the scripting code with the privileges of the target web service.

The vendor was notified on December 8, 2004.

Jeremy Bae at STG Security is credited with discovering this flaw.

Impact:   A remote user can upload and execute arbitrary PHP code on the target system. The code will run with the privileges of the target web service.
Solution:   The vendor has issued a patched version of 'UploadFile.php', available at:

http://kldp.net/forum/forum.php?forum_id=2085

Vendor URL:  moniwiki.sf.net/ (Links to External Site)
Cause:   Access control error, Input validation error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files with multiple extensions in MoniWiki


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files
with multiple extensions in MoniWiki

Revision 1.0
Date Published: 2004-12-15 (KST)
Last Update: 2004-12-15
Disclosed by SSR Team (advisory@stgsecurity.com)


Summary
========
MoniWiki is a wiki web application used by many Korean Linux users. However,
an input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
MoniWiki 1.0.9.2 and prior.

Vendor Status: FIXED
====================
2004-12-08 Vulnerability found.
2004-12-08 MoniWiki developer notified.
2004-12-09 First patch updated in CVS but didn't solve the problem.
2004-12-09 Second patch updated in CVS.
2004-12-15 Official release.

Details
=======
MoniWiki doesn't implemented in "UploadFile.php" to check multiple
extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers
can upload arbitrary script files (php, pl, cgi, etc) to a web server. This
is originated from a feature of Apache MIME module (mod_mime), which regards
attack.php.hwp as a normal PHP file and execute the file through mod_php
module with the privilege of the HTTPD process.

cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple
Extensions" : it's a feature, not a bug.

Solution
=========
Update to patched version of UploadFile.php
http://kldp.net/forum/forum.php?forum_id=2085

Vendor URL
==========
http://kldp.net/projects/moniwiki/

Credits
======
Jeremy Bae at STG Security

-----BEGIN PGP SIGNATURE-----
Version: PGP 8.0

iQA/AwUBQcAa3j9dVHd/hpsuEQLOaQCg/ru5kJbeRwbzwKwyANDbnLcNQc0AmwWw
LvcLdvPvzrepGaL1wY/mtDcH
=rWKf
-----END PGP SIGNATURE-----
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC