MediaWiki < 1.19.11 / 1.21.5 / 1.22.2 Multiple Remote Code Execution Vulnerabilities

Medium Nessus Plugin ID 72215

Synopsis

The remote web server contains an application that is affected by multiple remote code execution vulnerabilities.

Description

According to its version number, the instance of MediaWiki running on the remote host is affected by the following remote code execution vulnerabilities :

- A user-input validation error exists during thumbnail generation in the 'thumb.php' script that allows the execution of arbitrary shell commands via a specially crafted DjVu file.

- A user-input validation error exists in the 'pdfhandler_body.php' script used by the PdfHandler extension that allows the execution of arbitrary shell commands via a specially crafted PDF file.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number. Also note that the affected features are not enabled by default.

Solution

Upgrade to MediaWiki version 1.19.11 / 1.21.5 / 1.22.2 or later.

See Also

https://seclists.org/fulldisclosure/2014/Feb/6

http://www.nessus.org/u?f8ca1fc8

https://www.mediawiki.org/wiki/Release_notes/1.19

https://www.mediawiki.org/wiki/Release_notes/1.21

https://www.mediawiki.org/wiki/Release_notes/1.22

http://www.nessus.org/u?92483abd

Plugin Details

Severity: Medium

ID: 72215

File Name: mediawiki_1_19_11.nasl

Version: 1.12

Type: remote

Family: CGI abuses

Published: 2014/01/30

Updated: 2019/11/26

Dependencies: 19233

Configuration: Enable paranoid mode

Risk Information

Risk Factor: Medium

CVSS Score Source: CVE-2014-1610

CVSS v2.0

Base Score: 6

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P

Temporal Vector: CVSS2#E:F/RL:OF/RC:C

Vulnerability Information

CPE: cpe:/a:mediawiki:mediawiki

Required KB Items: Settings/ParanoidReport, installed_sw/MediaWiki, www/PHP

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 2014/01/28

Vulnerability Publication Date: 2014/01/28

Exploitable With

Core Impact

Metasploit (MediaWiki Thumb.php Remote Command Execution)

Elliot (MediaWiki thumb.php page Parameter Remote Shell Command Injection)

Reference Information

CVE: CVE-2014-1610

BID: 65223