Message-Id: <7745CDED-4474-43BB-89A3-EB74A67B8E9B@thoeny.org>
Date: Fri, 14 Dec 2012 08:01:22 -0800
From: Peter Thoeny <peter09@...eny.org>
To: full-disclosure@...ts.grok.org.uk
Subject: Security Alert CVE-2012-6329: TWiki MAKETEXT
	Variable Allows Arbitrary Shell Command Execution

This security advisory alerts you of a potential security issue with  
TWiki installations:
The %MAKETEXT{}% TWiki variable allows arbitrary shell command  
execution. The problem is caused by an underlying security issue in  
the Locale::Maketext CPAN module.

  * Vulnerable Software Version
  * Attack Vectors
  * Impact
  * Severity Level
  * MITRE Name for this Vulnerability
  * Details
  * Countermeasures
  * Hotfix for TWiki Production Releases 5.1.x
  * Hotfix for older affected TWiki Releases
  * Authors and Credits
  * Action Plan with Timeline
  * External Links
  * Feedback

---++ Vulnerable Software Version

  * TWiki-5.1.0 to TWiki-5.1.2 (TWikiRelease05x01x00 to  
TWikiRelease05x01x02)
  * TWiki-5.0.x (TWikiRelease05x00x00 to TWikiRelease05x00x02)
  * TWiki-4.3.x (TWikiRelease04x03x00 to TWikiRelease04x03x02)
  * TWiki-4.2.x (TWikiRelease04x02x00 to TWikiRelease04x02x04)
  * TWiki-4.1.x (TWikiRelease04x01x00 to TWikiRelease04x01x02)
  * TWiki-4.0.x (TWikiRelease04x00x00 to TWikiRelease04x00x05)

---++ Attack Vectors

Editing wiki pages and HTTP POST requests towards a TWiki server with  
enabled localization (typically port 80/TCP). Typically, prior  
authentication is necessary.

---++ Impact

An unauthenticated remote attacker can execute arbitrary shell  
commands as the webserver user, such as user nobody.

---++ Severity Level

The TWiki SecurityTeam triaged this issue as documented in  
TWikiSecurityAlertProcess [1] and assigned the following severity level:

  * Severity 1 issue: The web server can be compromised

---++ MITRE Name for this Vulnerability

The Common Vulnerabilities and Exposures project has assigned the name  
CVE-2012-6329 [7] to this vulnerability.

---++ Details

1. Shell Command execution: The %MAKETEXT{}% TWiki variable is used to  
localize user interface content to a language of choice. Using a  
specially crafted MAKETEXT, a malicious user can execute shell  
commands by Perl backtick (``) operators. User input is passed to the  
Perl "eval" command without first being sanitized. The problem is  
caused by an underlying security issue in the Locale::Maketext CPAN  
module. This works only in TWiki sites that have user interface  
localization enabled.

In addition, there are two less severe issues with MAKETEXT:

2. Excessive memory allocation: %MAKETEXT{"This is [_9999999999999999]  
Evil"}% will consume all memory and swap space attempting to  
initialize all missing entries in the parameters array.

3. Crash: %MAKETEXT{"This is [_0] problematic"}% can cause a crash  
under some circumstances.

---++ Countermeasures

  * One of:
    * Disable localization by setting configure flag  
{UserInterfaceInternationalisation} to 0.
    * Apply hotfix (see patch below).
    * Upgrade to the latest patched production release TWiki-5.1.3  
(TWikiRelease05x01x03) [2] when available.

  * In addition:
    * Install CPAN's Locale::Maketext version 1.23 or newer.
    * Use the {SafeEnvPath} configure setting to restrict the possible  
directories that are searched for executables.  By default, this is  
the PATH used by the webserver user. Set {SafeEnvPath} to a list of  
non-writable directories, such as "/bin:/usr/bin".

---++ Hotfix for TWiki Production Release 5.1.x

Affected file: twiki/lib/TWiki.pm

Patch to sanitize MAKETEXT parameters:

=======( CUT 8><--- )===============================================
--- TWiki.pm	(revision 24029)
+++ TWiki.pm	(working copy)
@@ -4329,8 +4329,23 @@

      # unescape parameters and calculate highest parameter number:
      my $max = 0;
-    $str =~ s/~\[(\_(\d+))~\]/ $max = $2 if ($2 > $max); "[$1]"/ge;
-    $str =~ s/~\[(\*,\_(\d+),[^,]+(,([^,]+))?)~\]/ $max = $2 if ($2 >  
$max); "[$1]"/ge;
+    my $min = 1;
+    $str =~ s/~\[(\_(\d+))~\]/
+              $max = $2 if ($2 > $max);
+              $min = $2 if ($2 < $min);
+              "[$1]"/ge;
+    $str =~ s/~\[(\*,\_(\d+),[^,]+(,([^,]+))?)~\]/
+              $max = $2 if ($2 > $max);
+              $min = $2 if ($2 < $min);
+              "[$1]"/ge;
+
+    # Item7080: Sanitize MAKETEXT variable:
+    return "MAKETEXT error: No more than 32 parameters are allowed"  
if( $max > 32 );
+    return "MAKETEXT error: Parameter 0 is not allowed" if( $min < 1 );
+    if( $TWiki::cfg{UserInterfaceInternationalisation} ) {
+        eval { require Locale::Maketext; };
+        $str =~ s#\\#\\\\#g if( $@ || !$@ &&  
$Locale::Maketext::VERSION < 1.23 );
+    }

      # get the args to be interpolated.
      my $argsStr = $params->{args} || "";
=======( CUT 8><--- )===============================================

This patch is also available separately [3] in case this gets mangled  
by the e-mail.

On a properly patched system, %MAKETEXT{" [_99] "}% should return this  
error: "MAKETEXT error: No more than 32 parameters are allowed"

---++ Hotfix for older affected TWiki Releases

Apply above patch (line numbers may vary).

---++ Authors and Credits

  * Credit to TWiki:Main.GeorgeClark for disclosing the issue to the twiki-security@...ts.sourceforge.net 
  mailing list, and for providing a proposed fix.
  * TWiki:Main.PeterThoeny for creating the fix, patch and advisory.

---++ Action Plan with Timeline

  * 2012-12-10: User discloses issue to TWikiSecurityMailingList [4],  
George Clark, Foswiki
  * 2012-12-10: Developer verifies issue, Peter Thoeny
  * 2012-12-10: Developer fixes code, Peter Thoeny
  * 2012-12-10: Security team creates advisory with hotfix, Peter Thoeny
  * 2012-12-11: Developer verifies patch, Hideyo Imazu
  * 2012-12-12: Send alert to TWikiAnnounceMailingList [5] and  
TWikiDevMailingList [6], Peter Thoeny
  * 2012-12-14: Publish advisory in Codev web and update all related  
topics, Peter Thoeny
  * 2012-12-14: Issue a public security advisory to full- 
disclosure[at]lists.grok.org.uk, cert[at]cert.org,  
vuln[at]secunia.com, bugs[at]securitytracker.com, Peter Thoeny

---++ External Links

[1]: http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlertProcess
[2]: http://twiki.org/cgi-bin/view/Codev/TWikiRelease05x01x03
[3]: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
[4]: http://twiki.org/cgi-bin/view/Codev/TWikiSecurityMailingList
[5]: http://twiki.org/cgi-bin/view/Codev/TWikiAnnounceMailingList
[6]: http://twiki.org/cgi-bin/view/Codev/TWikiDevMailingList
[7]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329 - CVE  
on MITRE.org

---++ Feedback

Please provide feedback at the security alert topic,
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329

-- Main.PeterThoeny - 2012-12-14

-- 
   * Peter Thoeny     - peter09[at]thoeny.org
   * http://TWiki.org - is your team already TWiki enabled?
   * Knowledge cannot be managed, it can be discovered and shared
   * This e-mail is:   (_) private    (x) ask first    (_) public

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists