STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files

with multiple extensions in MoniWiki

Revision 1.0

Date Published: 2004-12-15 (KST)

Last Update: 2004-12-15

Disclosed by SSR Team (advisory (at) stgsecurity (dot) com [email concealed])

Summary

========

MoniWiki is a wiki web application used by many Korean Linux users. However,

an input validation flaw can cause malicious attackers to run arbitrary

commands with the privilege of the HTTPD process, which is typically run as

the nobody user.

Vulnerability Class

===================

Implementation Error: Input validation flaw

Impact

======

High : arbitrary command execution.

Affected Products

================

MoniWiki 1.0.9.2 and prior.

Vendor Status: FIXED

====================

2004-12-08 Vulnerability found.

2004-12-08 MoniWiki developer notified.

2004-12-09 First patch updated in CVS but didn't solve the problem.

2004-12-09 Second patch updated in CVS.

2004-12-15 Official release.

Details

=======

MoniWiki doesn't implemented in "UploadFile.php" to check multiple

extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers

can upload arbitrary script files (php, pl, cgi, etc) to a web server. This

is originated from a feature of Apache MIME module (mod_mime), which regards

attack.php.hwp as a normal PHP file and execute the file through mod_php

module with the privilege of the HTTPD process.

cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple

Extensions" : it's a feature, not a bug.

Solution

=========

Update to patched version of UploadFile.php

http://kldp.net/forum/forum.php?forum_id=2085

Vendor URL

==========

http://kldp.net/projects/moniwiki/

Credits

======

Jeremy Bae at STG Security

[ reply ]