[UNIX] MoniWiki Arbitrary File Uploading

From: SecuriTeam (support_at_securiteam.com)
Date: 12/16/04

  • Next message: SecuriTeam: "[UNIX] GNUBoard PHP Injection Vulnerability" 
    To: list@securiteam.com
Date: 16 Dec 2004 14:04:07 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MoniWiki Arbitrary File Uploading
    ------------------------------------------------------------------------

    SUMMARY

     <http://kldp.net/projects/moniwiki/> MoniWiki is "a wiki web application
    used by many Korean Linux users. However, an input validation flaw can
    cause malicious attackers to run arbitrary commands with the privilege of
    the HTTPD process, which is typically run as the nobody user".

    Due to improper testing of incoming files, MoniWiki's files upload
    mechanism can be used to execute arbitrary code on the remote server (by
    uploading a PHP file, Perl scripts, etc).

    DETAILS

    Vulnerable Systems:
     * MoniWiki version 1.0.9.2 and prior

    MoniWiki doesn't implemented in "UploadFile.php" a check for multiple
    extensions in the files it receives as uploads (e.g. attack.php.hwp).
    Therefore a malicious attacker can upload an arbitrary script files (with
    the extension of PHP, PL, CGI, etc) to a web server.

    This vulnerability allows an attacker to cause the execution of arbitrary
    code whenever the Apache's MIME module (mod_mime) is in use. As Appache's
    MIME module regards attack.php.hwp as a normal PHP file and execute the
    file through mod_php module with the privilege of the HTTPD process.

    Solution:
    A patch is available for the UploadFile.php file from:
    <http://kldp.net/forum/forum.php?forum_id=2085>
    http://kldp.net/forum/forum.php?forum_id=2085

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:advisory@stgsecurity.com>
    SSR Team.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] GNUBoard PHP Injection Vulnerability"

    Relevant Pages

    • [NT] DeskNow Mail and Collaboration Server Directory Traversal Vulnerabilities
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Collaboration Server is "a full-featured and integrated mail and instant ... attachment upload feature that may be exploited to upload files to ... * DeskNow Mail and Collaboration Server version 2.5.12 and prior ...
      (Securiteam)
    • [UNIX] LightBlog Arbitrary File Upload Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... LightBlog Arbitrary File Upload Vulnerability ...
      (Securiteam)
    • [NT] Kyocera Mita Scanner File Utility (Multiple)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Part of the solution requires a listener at the PC/Mac, ... Unauthorized document upload - The listener works in conjunction with the ... This provides an attacker with the ability to directly upload a file to ...
      (Securiteam)
    • [UNIX] DoKuWiki Weak File Validation
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Weak file validation in DoKuWiki allows user with upload privileges to ... extension, this by appending an allowed extension into the middle of the ...
      (Securiteam)
    • [UNIX] YaPiG add_comment.php PHP Code Injection
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... YaPiG is "a simple but powerful web album ... * YaPiG version 0.92b (Latest downloaded files appear to be immune to PHP ... This Proof of Concept creates a php file that echoes a notice. ...
      (Securiteam)