Directory traversal vulnerability in bin/configure in TWiki before 4.2.3, when a certain step in the installation guide is skipped, allows remote attackers to read arbitrary files via a query string containing a .. (dot dot) in the image variable, and execute arbitrary files via unspecified vectors.

It was discovered that twiki, a web-based collaboration platform, didn't properly sanitize the image parameter in its configuration script. This could allow remote users to execute arbitrary commands upon the system, or read any files which were readable by the webserver user.

Th1nk3r reports :

The version of TWiki installed on the remote host allows access to the 'configure' script and fails to sanitize the 'image' parameter of that script of directory traversal sequences before returning the file contents when the 'action' parameter is set to 'image'. An unauthenticated attacker can leverage this issue to view arbitrary files on the remote host subject to the privileges of the web server user id. .

The version of TWiki running on the remote host allows access to the 'configure' script, and fails to sanitize the 'image' parameter of that script. When the 'action' parameter is set to 'image', an unauthenticated attacker can exploit this issue to execute arbitrary code or to view arbitrary files on the remote host subject to the privileges of the web server user id.

Note that the TWiki Installation Guide says the 'configure' script should never be left open to the public.

ID	Name	Product	Family	Severity
34246	Debian DSA-1639-1 : twiki - command execution	Nessus	Debian Local Security Checks	medium
34206	FreeBSD : twiki -- Arbitrary code execution in session files (9227dcaf-827f-11dd-9cd7-0050568452ac)	Nessus	FreeBSD Local Security Checks	medium
34031	TWiki bin/configure 'image' Parameter Traversal Arbitrary File Access/Execution	Nessus	CGI abuses	high

Detections

Analytics

CVE-2008-3195

high

Tenable Plugins

medium

medium

high