SkipNavigation
Home | FAQ | Contact | Privacy Policy
US-CERT
American Flag
  Vulnerability
Notes
Database

Search Vulnerability Notes

Vulnerability Notes Help Information


 
 View Notes By
  Name

ID Number

CVE Name

Date Public

Date Published

Date Updated

Severity Metric
 Other Documents
  Technical Alerts

Technical Bulletins

Alerts

Security Tips
 

Vulnerability Note VU#757181

TWiki does not properly sanitize URI parameters

Overview

A lack of input validation in the TWiki revision control function may allow a remote, unauthenticated attacker to execute arbitrary commands.

I. Description

TWiki is a web-based collaborative publishing environment. TWiki does not sanitize user-controlled URI parameters supplied to the revision control function for malicious content. Specifically, the rev parameter is not filtered for shell metacharacters before being used to construct a shell command. By sending a specially crafted URI to a system running TWiki, an remote, unauthenticated attacker may be able to execute arbitrary commands on that system.

Note that exploits are publicly available for this vulnerability. More detailed information is available in the TWiki Security Alert.

II. Impact

By sending a specially crafted URI to TWiki, a remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the CGI process, typically nobody.

III. Solution

Apply hotfix

TWiki has release a hotfix to address this issue.

Restrict access

Restricting access to TWiki to only trusted users will reduce the chances of exploitation.

Systems Affected

VendorStatusDate Updated
TWikiVulnerable23-Sep-2005

References


http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
http://secunia.com/advisories/16820/
http://securitytracker.com/alerts/2005/Sep/1014918.html
http://www.securityfocus.com/bid/14834
http://twiki.org

Credit

This vulnerability was reported by Sap. TWiki credits PeterThoeny, Crawford Currie, Sven Dowideit, Colas Nahaboo, Will Norris, Richard Donkin, B4dP4nd4 and Florian Weimer for providing information regarding this issue.

This document was written by Jeff Gennari.

Other Information

Date Public09/14/2005
Date First Published09/20/2005 11:07:31 AM
Date Last Updated10/04/2005
CERT Advisory 
CVE NameCAN-2005-2877
US-CERT Technical Alerts 
Metric12.57
Document Revision46

If you have feedback, comments, or additional information about this vulnerability, please send us email.
 

 
Page Corner Image
Produced 2005 by US-CERT, a government organization
Disclaimers and copyright information
Get Adobe Reader Get Adobe Reader