[Full-Disclosure] STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files with multiple extensions in MoniWiki

From: SSR Team (advisory_at_stgsecurity.com)
Date: 12/15/04

  • Next message: SSR Team: "[Full-Disclosure] STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability"
    To: <vuln@secunia.com>, <news@securiteam.com>, <bugs@securitytracker.com>, <full-disclosure@lists.netsys.com>, <staff@packetstormsecurity.com>
    Date: Wed, 15 Dec 2004 20:08:04 +0900
    
    

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files
    with multiple extensions in MoniWiki

    Revision 1.0
    Date Published: 2004-12-15 (KST)
    Last Update: 2004-12-15
    Disclosed by SSR Team (advisory@stgsecurity.com)

    Summary
    ========
    MoniWiki is a wiki web application used by many Korean Linux users. However,
    an input validation flaw can cause malicious attackers to run arbitrary
    commands with the privilege of the HTTPD process, which is typically run as
    the nobody user.

    Vulnerability Class
    ===================
    Implementation Error: Input validation flaw

    Impact
    ======
    High : arbitrary command execution.

    Affected Products
    ================
    MoniWiki 1.0.9.2 and prior.

    Vendor Status: FIXED
    ====================
    2004-12-08 Vulnerability found.
    2004-12-08 MoniWiki developer notified.
    2004-12-09 First patch updated in CVS but didn't solve the problem.
    2004-12-09 Second patch updated in CVS.
    2004-12-15 Official release.

    Details
    =======
    MoniWiki doesn't implemented in "UploadFile.php" to check multiple
    extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers
    can upload arbitrary script files (php, pl, cgi, etc) to a web server. This
    is originated from a feature of Apache MIME module (mod_mime), which regards
    attack.php.hwp as a normal PHP file and execute the file through mod_php
    module with the privilege of the HTTPD process.

    cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple
    Extensions" : it's a feature, not a bug.

    Solution
    =========
    Update to patched version of UploadFile.php
    http://kldp.net/forum/forum.php?forum_id=2085

    Vendor URL
    ==========
    http://kldp.net/projects/moniwiki/

    Credits
    ======
    Jeremy Bae at STG Security

    -----BEGIN PGP SIGNATURE-----
    Version: PGP 8.0

    iQA/AwUBQcAa3j9dVHd/hpsuEQLOaQCg/ru5kJbeRwbzwKwyANDbnLcNQc0AmwWw
    LvcLdvPvzrepGaL1wY/mtDcH
    =rWKf
    -----END PGP SIGNATURE-----

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: SSR Team: "[Full-Disclosure] STG Security Advisory: [SSA-20041214-14] GNUBoard PHP injection vulnerability"