full-disclosure - CVE-2014-1686 -- Information disclosure: webserver source path in Mediawiki 1.18.0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <531FA849.4050903@gmail.com>
Date: Wed, 12 Mar 2014 00:20:25 +0000
From: "alejandr0.w3b.p0wn3r" <alejandr0.w3b.p0wn3r@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: CVE-2014-1686 -- Information disclosure:
 webserver source path in Mediawiki 1.18.0

CVE-2014-1686 -- Information disclosure: webserver source path in
Mediawiki 1.18.0

When a user create a new file (eg: image) with a name containing *, it
leads to webserver file path disclosure, after having uploaded the file,
when thumbail creation occurs.

I did not succeed in obtained remote shell code execution, but this may
be a vulnerable path.

Counter-measure: refuse creation of file containing a *
backported the patch in 1.19 and 1.20
Note, permissions when creating thumbnails can have the same outcome.

https://www.owasp.org/index.php/Information_Leakage

Download attachment "screenshot2.png" of type "image/png" (24676 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/