[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Security Alert CVE-2012-6329: TWiki MAKETEXT Variable Allows Arbitrary Shell Command Execution
- To: full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: [Full-disclosure] Security Alert CVE-2012-6329: TWiki MAKETEXT Variable Allows Arbitrary Shell Command Execution
- From: Peter Thoeny <peter09@xxxxxxxxxx>
- Date: Fri, 14 Dec 2012 08:01:22 -0800
This security advisory alerts you of a potential security issue with
TWiki installations:
The %MAKETEXT{}% TWiki variable allows arbitrary shell command
execution. The problem is caused by an underlying security issue in
the Locale::Maketext CPAN module.
* Vulnerable Software Version
* Attack Vectors
* Impact
* Severity Level
* MITRE Name for this Vulnerability
* Details
* Countermeasures
* Hotfix for TWiki Production Releases 5.1.x
* Hotfix for older affected TWiki Releases
* Authors and Credits
* Action Plan with Timeline
* External Links
* Feedback
---++ Vulnerable Software Version
* TWiki-5.1.0 to TWiki-5.1.2 (TWikiRelease05x01x00 to
TWikiRelease05x01x02)
* TWiki-5.0.x (TWikiRelease05x00x00 to TWikiRelease05x00x02)
* TWiki-4.3.x (TWikiRelease04x03x00 to TWikiRelease04x03x02)
* TWiki-4.2.x (TWikiRelease04x02x00 to TWikiRelease04x02x04)
* TWiki-4.1.x (TWikiRelease04x01x00 to TWikiRelease04x01x02)
* TWiki-4.0.x (TWikiRelease04x00x00 to TWikiRelease04x00x05)
---++ Attack Vectors
Editing wiki pages and HTTP POST requests towards a TWiki server with
enabled localization (typically port 80/TCP). Typically, prior
authentication is necessary.
---++ Impact
An unauthenticated remote attacker can execute arbitrary shell
commands as the webserver user, such as user nobody.
---++ Severity Level
The TWiki SecurityTeam triaged this issue as documented in
TWikiSecurityAlertProcess [1] and assigned the following severity level:
* Severity 1 issue: The web server can be compromised
---++ MITRE Name for this Vulnerability
The Common Vulnerabilities and Exposures project has assigned the name
CVE-2012-6329 [7] to this vulnerability.
---++ Details
1. Shell Command execution: The %MAKETEXT{}% TWiki variable is used to
localize user interface content to a language of choice. Using a
specially crafted MAKETEXT, a malicious user can execute shell
commands by Perl backtick (``) operators. User input is passed to the
Perl "eval" command without first being sanitized. The problem is
caused by an underlying security issue in the Locale::Maketext CPAN
module. This works only in TWiki sites that have user interface
localization enabled.
In addition, there are two less severe issues with MAKETEXT:
2. Excessive memory allocation: %MAKETEXT{"This is [_9999999999999999]
Evil"}% will consume all memory and swap space attempting to
initialize all missing entries in the parameters array.
3. Crash: %MAKETEXT{"This is [_0] problematic"}% can cause a crash
under some circumstances.
---++ Countermeasures
* One of:
* Disable localization by setting configure flag
{UserInterfaceInternationalisation} to 0.
* Apply hotfix (see patch below).
* Upgrade to the latest patched production release TWiki-5.1.3
(TWikiRelease05x01x03) [2] when available.
* In addition:
* Install CPAN's Locale::Maketext version 1.23 or newer.
* Use the {SafeEnvPath} configure setting to restrict the possible
directories that are searched for executables. By default, this is
the PATH used by the webserver user. Set {SafeEnvPath} to a list of
non-writable directories, such as "/bin:/usr/bin".
---++ Hotfix for TWiki Production Release 5.1.x
Affected file: twiki/lib/TWiki.pm
Patch to sanitize MAKETEXT parameters:
=======( CUT 8><--- )===============================================
--- TWiki.pm (revision 24029)
+++ TWiki.pm (working copy)
@@ -4329,8 +4329,23 @@
# unescape parameters and calculate highest parameter number:
my $max = 0;
- $str =~ s/~\[(\_(\d+))~\]/ $max = $2 if ($2 > $max); "[$1]"/ge;
- $str =~ s/~\[(\*,\_(\d+),[^,]+(,([^,]+))?)~\]/ $max = $2 if ($2 >
$max); "[$1]"/ge;
+ my $min = 1;
+ $str =~ s/~\[(\_(\d+))~\]/
+ $max = $2 if ($2 > $max);
+ $min = $2 if ($2 < $min);
+ "[$1]"/ge;
+ $str =~ s/~\[(\*,\_(\d+),[^,]+(,([^,]+))?)~\]/
+ $max = $2 if ($2 > $max);
+ $min = $2 if ($2 < $min);
+ "[$1]"/ge;
+
+ # Item7080: Sanitize MAKETEXT variable:
+ return "MAKETEXT error: No more than 32 parameters are allowed"
if( $max > 32 );
+ return "MAKETEXT error: Parameter 0 is not allowed" if( $min < 1 );
+ if( $TWiki::cfg{UserInterfaceInternationalisation} ) {
+ eval { require Locale::Maketext; };
+ $str =~ s#\\#\\\\#g if( $@ || !$@ &&
$Locale::Maketext::VERSION < 1.23 );
+ }
# get the args to be interpolated.
my $argsStr = $params->{args} || "";
=======( CUT 8><--- )===============================================
This patch is also available separately [3] in case this gets mangled
by the e-mail.
On a properly patched system, %MAKETEXT{" [_99] "}% should return this
error: "MAKETEXT error: No more than 32 parameters are allowed"
---++ Hotfix for older affected TWiki Releases
Apply above patch (line numbers may vary).
---++ Authors and Credits
* Credit to TWiki:Main.GeorgeClark for disclosing the issue to the
twiki-security@xxxxxxxxxxxxxxxxxxxxx
mailing list, and for providing a proposed fix.
* TWiki:Main.PeterThoeny for creating the fix, patch and advisory.
---++ Action Plan with Timeline
* 2012-12-10: User discloses issue to TWikiSecurityMailingList [4],
George Clark, Foswiki
* 2012-12-10: Developer verifies issue, Peter Thoeny
* 2012-12-10: Developer fixes code, Peter Thoeny
* 2012-12-10: Security team creates advisory with hotfix, Peter Thoeny
* 2012-12-11: Developer verifies patch, Hideyo Imazu
* 2012-12-12: Send alert to TWikiAnnounceMailingList [5] and
TWikiDevMailingList [6], Peter Thoeny
* 2012-12-14: Publish advisory in Codev web and update all related
topics, Peter Thoeny
* 2012-12-14: Issue a public security advisory to full-
disclosure[at]lists.grok.org.uk, cert[at]cert.org,
vuln[at]secunia.com, bugs[at]securitytracker.com, Peter Thoeny
---++ External Links
[1]: http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlertProcess
[2]: http://twiki.org/cgi-bin/view/Codev/TWikiRelease05x01x03
[3]: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
[4]: http://twiki.org/cgi-bin/view/Codev/TWikiSecurityMailingList
[5]: http://twiki.org/cgi-bin/view/Codev/TWikiAnnounceMailingList
[6]: http://twiki.org/cgi-bin/view/Codev/TWikiDevMailingList
[7]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6329 - CVE
on MITRE.org
---++ Feedback
Please provide feedback at the security alert topic,
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2012-6329
-- Main.PeterThoeny - 2012-12-14
--
* Peter Thoeny - peter09[at]thoeny.org
* http://TWiki.org - is your team already TWiki enabled?
* Knowledge cannot be managed, it can be discovered and shared
* This e-mail is: (_) private (x) ask first (_) public
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/