MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

The remote Debian host is missing a security update. It is, therefore, affected by multiple vulnerabilities in MediaWiki :

  - A cross-site scripting (XSS) vulnerability exists due to     a failure to validate input before returning it to the     user. An unauthenticated, remote attacker can exploit     this, via specially crafted SVG files, to execute     arbitrary script code in the user's browser session.
    (CVE-2013-2031)

  - A flaw exists in the password blocking mechanism due to     two different tools being used to block password change     requests, these being Special:PasswordReset and     Special:ChangePassword, either of which may be bypassed     by the method the other prevents. A remote attacker can     exploit this issue to change passwords. (CVE-2013-2032)

  - Multiple flaws exist in Sanitizer::checkCss due to the     improper sanitization of user-supplied input. An     unauthenticated, remote attacker can exploit these to     bypass the blacklist. (CVE-2013-4567, CVE-2013-4568)

  - A flaw exists due to multiple users being granted the     same session ID within HTTP headers. A remote attacker     can exploit this to authenticate as another random     user. (CVE-2013-4572)

  - A cross-site scripting (XSS) vulnerability exists in the     /includes/libs/XmlTypeCheck.php script due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this, via a specially     crafted XSL file, to execute arbitrary script code in     the user's browser session. (CVE-2013-6452)

  - A flaw exists in the /includes/upload/UploadBase.php     script due to a failure to apply SVG sanitization when     XML files are read as invalid. An unauthenticated,     remote attacker can exploit this to upload non-sanitized     XML files, resulting in an unspecified impact.
    (CVE-2013-6453)

  - A stored cross-site (XSS) scripting vulnerability exists     in the /includes/Sanitizer.php script due to a failure     to properly validate the '-o-link' attribute before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in the user's     browser session. (CVE-2013-6454)

  - A flaw exists in the log API within the     /includes/api/ApiQueryLogEvents.php script that allows     an unauthenticated, remote attacker to disclose     potentially sensitive information regarding deleted     pages. (CVE-2013-6472)

  - Multiple flaws exist in the PdfHandler_body.php,     DjVu.php, Bitmap.php, and ImageHandler.php scripts when     DjVu or PDF file upload support is enabled due to     improper sanitization of user-supplied input. An     authenticated, remote attacker can exploit these, via     the use of shell metacharacters, to execute execute     arbitrary shell commands. (CVE-2014-1610)

  - A cross-site request forgery (XSRF) vulnerability exists     in the includes/specials/SpecialChangePassword.php     script due to a failure to properly handle a correctly     authenticated but unintended login attempt. An     unauthenticated, remote attacker, by convincing a user     to follow a specially crafted link, can exploit this to     reset the user's password. (CVE-2014-2665)

Updated mediawiki packages fix multiple vulnerabilities :

MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS (CVE-2013-6451).

Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript (CVE-2013-6452).

During internal review, it was discovered that MediaWiki's SVG sanitization could be bypassed when the XML was considered invalid (CVE-2013-6453).

During internal review, it was discovered that MediaWiki displayed some information about deleted pages in the log API, enhanced RecentChanges, and user watchlists (CVE-2013-6472).

Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files.
Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way (CVE-2014-1610).

MediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML namespace, in uploaded SVG files. Some client software may use these namespaces in a way that results in XSS. This was fixed by disallowing uploading SVG files using non-whitelisted namespaces (CVE-2014-2242).

MediaWiki before 1.22.3 performs token comparison that may be vulnerable to timing attacks. This was fixed by making token comparison use constant time (CVE-2014-2243).

MediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due to flaw with link handling in api.php. This was fixed such that it won't find links in the middle of api.php links (CVE-2014-2244).

MediaWiki has been updated to version 1.22.3, which fixes these issues, as well as several others.

Also, the mediawiki-ldapauthentication and mediawiki-math extensions have been updated to newer versions that are compatible with MediaWiki 1.22.

Additionally, the mediawiki-graphviz extension has been obsoleted, due to the fact that it is unmaintained upstream and is vulnerable to cross-site scripting attacks.

Note: if you were using the instances feature in these packages to support multiple wiki instances, this feature has now been removed.
You will need to maintain separate wiki instances manually.

The version of MediaWiki running on the remote host is affected by a remote command injection vulnerability due to a failure to properly sanitize user-supplied input to the 'w' parameter in the 'thumb.php' script. A remote, unauthenticated attacker can exploit this issue to execute arbitrary commands and/or execute arbitrary code on the remote host.

Note that the application is also affected by an additional command injection issue. However, Nessus has not tested for this additional issue.

Note also that PDF file upload support and the PdfHandler extension must be enabled in order to exploit this issue.

- Update to 1.21.5

    - (bug 60339) (CVE-2014-1610) SECURITY: Reported RCE in       djvu thumbnailing

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its version number, the instance of MediaWiki running on the remote host is affected by the following remote code execution vulnerabilities :

  - A user-input validation error exists during thumbnail     generation in the 'thumb.php' script that allows the     execution of arbitrary shell commands via a specially     crafted DjVu file.

  - A user-input validation error exists in the     'pdfhandler_body.php' script used by the PdfHandler     extension that allows the execution of arbitrary shell     commands via a specially crafted PDF file.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Also note that the affected features are not enabled by default.

ID	Name	Product	Family	Severity
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
73256	Debian DSA-2891-1 : mediawiki, mediawiki-extensions Multiple Vulnerabilities	Nessus	Debian Local Security Checks	high
73004	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:057)	Nessus	Mandriva Local Security Checks	high
72618	MediaWiki thumb.php 'w' Parameter Remote Shell Command Injection	Nessus	CGI abuses	high
72379	Fedora 19 : mediawiki-1.21.5-1.fc19 (2014-1802)	Nessus	Fedora Local Security Checks	medium
72376	Fedora 20 : mediawiki-1.21.5-1.fc20 (2014-1745)	Nessus	Fedora Local Security Checks	medium
72215	MediaWiki < 1.19.11 / 1.21.5 / 1.22.2 Multiple Remote Code Execution Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-1610

critical

Tenable Plugins

critical

high

high

high

medium

medium

medium