bugtraq - STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files with multiple extensions in MoniWiki

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20041215181301.21474.qmail@www.securityfocus.com>
Date: 15 Dec 2004 18:13:01 -0000
From: <advisory@...security.com>
To: bugtraq@...urityfocus.com
Subject: STG Security Advisory: [SSA-20041215-15] Vulnerability of
    uploading files with multiple extensions in MoniWiki

STG Security Advisory: [SSA-20041215-15] Vulnerability of uploading files
with multiple extensions in MoniWiki

Revision 1.0
Date Published: 2004-12-15 (KST)
Last Update: 2004-12-15
Disclosed by SSR Team (advisory@...security.com)

Summary
========
MoniWiki is a wiki web application used by many Korean Linux users. However,
an input validation flaw can cause malicious attackers to run arbitrary
commands with the privilege of the HTTPD process, which is typically run as
the nobody user.

Vulnerability Class
===================
Implementation Error: Input validation flaw

Impact
======
High : arbitrary command execution.

Affected Products
================
MoniWiki 1.0.9.2 and prior.

Vendor Status: FIXED
====================
2004-12-08 Vulnerability found.
2004-12-08 MoniWiki developer notified.
2004-12-09 First patch updated in CVS but didn't solve the problem.
2004-12-09 Second patch updated in CVS.
2004-12-15 Official release.

Details
=======
MoniWiki doesn't implemented in "UploadFile.php" to check multiple
extensions of uploaded files, e.g. attack.php.hwp, so malicious attackers
can upload arbitrary script files (php, pl, cgi, etc) to a web server. This
is originated from a feature of Apache MIME module (mod_mime), which regards
attack.php.hwp as a normal PHP file and execute the file through mod_php
module with the privilege of the HTTPD process.

cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple
Extensions" : it's a feature, not a bug.

Solution
=========
Update to patched version of UploadFile.php
http://kldp.net/forum/forum.php?forum_id=2085

Vendor URL
==========
http://kldp.net/projects/moniwiki/

Credits
======
Jeremy Bae at STG Security