Vulnerabilities > CVE-2013-6453 - Improper Input Validation vulnerability in Mediawiki

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
mediawiki
CWE-20
nessus

Summary

MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 does not properly sanitize SVG files, which allows remote attackers to have unspecified impact via invalid XML.

Vulnerable Configurations

Part Description Count
Application
Mediawiki
209

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Server Side Include (SSI) Injection
    An attacker can use Server Side Include (SSI) Injection to send code to a web application that then gets executed by the web server. Doing so enables the attacker to achieve similar results to Cross Site Scripting, viz., arbitrary code execution and information disclosure, albeit on a more limited scale, since the SSI directives are nowhere near as powerful as a full-fledged scripting language. Nonetheless, the attacker can conveniently gain access to sensitive files, such as password files, and execute shell commands.
  • Cross Zone Scripting
    An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security. In a zone-based model, pages belong to one of a set of zones corresponding to the level of privilege assigned to that page. Pages in an untrusted zone would have a lesser level of access to the system and/or be restricted in the types of executable content it was allowed to invoke. In a cross-zone scripting attack, a page that should be assigned to a less privileged zone is granted the privileges of a more trusted zone. This can be accomplished by exploiting bugs in the browser, exploiting incorrect configuration in the zone controls, through a cross-site scripting attack that causes the attackers' content to be treated as coming from a more trusted page, or by leveraging some piece of system functionality that is accessible from both the trusted and less trusted zone. This attack differs from "Restful Privilege Escalation" in that the latter correlates to the inadequate securing of RESTful access methods (such as HTTP DELETE) on the server, while cross-zone scripting attacks the concept of security zones as implemented by a browser.
  • Cross Site Scripting through Log Files
    An attacker may leverage a system weakness where logs are susceptible to log injection to insert scripts into the system's logs. If these logs are later viewed by an administrator through a thin administrative interface and the log data is not properly HTML encoded before being written to the page, the attackers' scripts stored in the log will be executed in the administrative interface with potentially serious consequences. This attack pattern is really a combination of two other attack patterns: log injection and stored cross site scripting.
  • Command Line Execution through SQL Injection
    An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.

Nessus

  • NASL familyCGI abuses
    NASL idMEDIAWIKI_1_19_10.NASL
    descriptionAccording to its version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities : - Escape sequences are not properly sanitized when passed to the
    last seen2020-06-01
    modified2020-06-02
    plugin id72370
    published2014-02-06
    reporterThis script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/72370
    titleMediaWiki < 1.19.10 / 1.21.4 / 1.22.1 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(72370);
      script_version("1.13");
      script_cvs_date("Date: 2019/11/26");
    
      script_cve_id(
        "CVE-2013-4570",
        "CVE-2013-4571",
        "CVE-2013-4574",
        "CVE-2013-6451",
        "CVE-2013-6452",
        "CVE-2013-6453",
        "CVE-2013-6454",
        "CVE-2013-6455",
        "CVE-2013-6472",
        "CVE-2014-3454"
      );
      script_bugtraq_id(64966, 65003, 67522);
    
      script_name(english:"MediaWiki < 1.19.10 / 1.21.4 / 1.22.1 Multiple Vulnerabilities");
      script_summary(english:"Checks version of MediaWiki.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote web server contains an application that is affected by
    multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version number, the instance of MediaWiki running on
    the remote host is affected by the following vulnerabilities :
    
      - Escape sequences are not properly sanitized when passed
        to the 'Sanitizer::checkCss' class, which allows a
        remote attacker to conduct cross-site scripting attacks.
        (CVE-2013-6451)
    
      - An input validation error exists in the
        'XmlTypeCheck.php' script in uploaded SVG files that
        contain external style sheets, which allows a remote
        attacker to conduct cross-site scripting attacks.
        (CVE-2013-6452)
    
      - Input validation by the checkSvgScriptCallback()
        function is bypassed in the 'UploadBase.php' script
        when an SVG file with invalid XML is uploaded. This
        can result in malicious code execution. (CVE-2013-6453)
    
      - An input validation error exists in the 'Sanitizer.php'
        script when input is submitted to the '-o-link'
        attribute, which allows cross-site scripting attacks in
        Opera 12. (CVE-2013-6454)
    
      - An information disclosure vulnerability exists in the
        log API, Enhanced Recent Changes feature, and users'
        watchlists that allows deleted log entries to be viewed.
        (CVE-2013-6472)
    
    Additionally, the following extensions contain vulnerabilities but
    are not enabled or installed by default (unless otherwise noted) :
    
      - The TimedMediaHandler extension is affected by a
        cross-site scripting vulnerability due to the lack of
        input validation of the 'data-videopayload' attribute
        in the 'mw.PopUpThumbVideo.js' script. (CVE-2013-4574)
    
      - The Scribuntu extension is affected by a NULL pointer
        dereference and buffer overflow flaw in the
        implementation of the 'luasandbox' PHP extension that
        can lead to a denial of service or arbitrary code
        execution. (CVE-2013-4570, CVE-2013-4571)
    
      - The CentralAuth extension is affected by an information
        disclosure vulnerability due to the insertion of a
        username into the page's DOM. (CVE-2013-6455)
    
      - The Semantic Forms extension is affected by a cross-site
        request forgery (XSRF) vulnerability due to the lack of
        token validation in the 'Special:CreateCategory' page.
        (CVE-2014-3454)
    
    Note that Nessus has not tested for these issues but has instead
    relied on the application's self-reported version number.");
      # https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11acd3f1");
      script_set_attribute(attribute:"see_also", value:"https://www.mediawiki.org/wiki/Release_notes/1.19#MediaWiki_1.19.10");
      script_set_attribute(attribute:"see_also", value:"https://www.mediawiki.org/wiki/Release_notes/1.20#MediaWiki_1.21.4");
      script_set_attribute(attribute:"see_also", value:"https://www.mediawiki.org/wiki/Release_notes/1.22#MediaWiki_1.22.1");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to MediaWiki version 1.19.10 / 1.21.4 / 1.22.1 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-6453");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(20, 74, 79, 442, 629, 711, 712, 722, 725, 750, 751, 800, 801, 809, 811, 864, 900, 928, 931, 990);
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2013/06/17");
      script_set_attribute(attribute:"patch_publication_date", value:"2014/01/14");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/02/06");
    
      script_set_attribute(attribute:"potential_vulnerability", value:"true");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:mediawiki:mediawiki");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("mediawiki_detect.nasl");
      script_require_keys("Settings/ParanoidReport", "installed_sw/MediaWiki", "www/PHP");
      script_require_ports("Services/www", 80);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("http.inc");
    include("install_func.inc");
    
    app = "MediaWiki";
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:80, php:TRUE);
    
    install = get_single_install(
      app_name : app,
      port     : port,
      exit_if_unknown_ver : TRUE
    );
    version = install['version'];
    install_url = build_url(qs:install['path'], port:port);
    
    if (report_paranoia < 2) audit(AUDIT_PARANOID);
    
    if (
      version =~ "^1\.19\.[0-9]([^0-9]|$)" ||
      version =~ "^1\.21\.[0-3]([^0-9]|$)" ||
      version =~ "^1\.22\.[0]([^0-9]|$)"
    )
    {
      set_kb_item(name:'www/'+port+'/XSS', value:TRUE);
      set_kb_item(name:'www/'+port+'/XSRF', value:TRUE);
    
      if (report_verbosity > 0)
      {
        report =
          '\n  URL               : ' + install_url +
          '\n  Installed version : ' + version +
          '\n  Fixed versions    : 1.19.10 / 1.21.4 / 1.22.1' +
          '\n';
        security_hole(port:port, extra:report);
      }
      else security_hole(port);
    }
    else audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url, version);
    
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-201502-04.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in MediaWiki. Please review the CVE identifiers and MediaWiki announcement referenced below for details. Impact : A remote attacker may be able to execute arbitrary code with the privileges of the process, create a Denial of Service condition, obtain sensitive information, bypass security restrictions, and inject arbitrary web script or HTML. Workaround : There is no known workaround at this time.
    last seen2020-06-01
    modified2020-06-02
    plugin id81227
    published2015-02-09
    reporterThis script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/81227
    titleGLSA-201502-04 : MediaWiki: Multiple vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Gentoo Linux Security Advisory GLSA 201502-04.
    #
    # The advisory text is Copyright (C) 2001-2019 Gentoo Foundation, Inc.
    # and licensed under the Creative Commons - Attribution / Share Alike 
    # license. See http://creativecommons.org/licenses/by-sa/3.0/
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(81227);
      script_version("1.5");
      script_cvs_date("Date: 2019/02/07  9:34:55");
    
      script_cve_id("CVE-2013-6451", "CVE-2013-6452", "CVE-2013-6453", "CVE-2013-6454", "CVE-2013-6472", "CVE-2014-1610", "CVE-2014-2242", "CVE-2014-2243", "CVE-2014-2244", "CVE-2014-2665", "CVE-2014-2853", "CVE-2014-5241", "CVE-2014-5242", "CVE-2014-5243", "CVE-2014-7199", "CVE-2014-7295", "CVE-2014-9276", "CVE-2014-9277", "CVE-2014-9475", "CVE-2014-9476", "CVE-2014-9477", "CVE-2014-9478", "CVE-2014-9479", "CVE-2014-9480", "CVE-2014-9481", "CVE-2014-9487", "CVE-2014-9507");
      script_xref(name:"GLSA", value:"201502-04");
    
      script_name(english:"GLSA-201502-04 : MediaWiki: Multiple vulnerabilities");
      script_summary(english:"Checks for updated package(s) in /var/db/pkg");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Gentoo host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "The remote host is affected by the vulnerability described in GLSA-201502-04
    (MediaWiki: Multiple vulnerabilities)
    
        Multiple vulnerabilities have been discovered in MediaWiki. Please
          review the CVE identifiers and MediaWiki announcement referenced below
          for details.
      
    Impact :
    
        A remote attacker may be able to execute arbitrary code with the
          privileges of the process, create a Denial of Service condition, obtain
          sensitive information, bypass security restrictions, and inject arbitrary
          web script or HTML.
      
    Workaround :
    
        There is no known workaround at this time."
      );
      # https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-June/000155.html
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?4ef35312"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://security.gentoo.org/glsa/201502-04"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "All MediaWiki 1.23 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-apps/mediawiki-1.23.8'
        All MediaWiki 1.22 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-apps/mediawiki-1.22.15'
        All MediaWiki 1.19 users should upgrade to the latest version:
          # emerge --sync
          # emerge --ask --oneshot --verbose '>=www-apps/mediawiki-1.19.23'"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"d2_elliot_name", value:"MediaWiki thumb.php page Parameter Remote Shell Command Injection");
      script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'MediaWiki Thumb.php Remote Command Execution');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:mediawiki");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/01/30");
      script_set_attribute(attribute:"patch_publication_date", value:"2015/02/07");
      script_set_attribute(attribute:"plugin_publication_date", value:"2015/02/09");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2015-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Gentoo Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("qpkg.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
    if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    
    if (qpkg_check(package:"www-apps/mediawiki", unaffected:make_list("ge 1.23.8", "rge 1.22.15", "rge 1.19.23"), vulnerable:make_list("lt 1.23.8"))) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());
      else security_hole(0);
      exit(0);
    }
    else
    {
      tested = qpkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "MediaWiki");
    }
    
  • NASL familyMandriva Local Security Checks
    NASL idMANDRIVA_MDVSA-2014-057.NASL
    descriptionUpdated mediawiki packages fix multiple vulnerabilities : MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS (CVE-2013-6451). Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript (CVE-2013-6452). During internal review, it was discovered that MediaWiki
    last seen2020-06-01
    modified2020-06-02
    plugin id73004
    published2014-03-14
    reporterThis script is Copyright (C) 2014-2019 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73004
    titleMandriva Linux Security Advisory : mediawiki (MDVSA-2014:057)
    code
    #%NASL_MIN_LEVEL 80502
    
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were  
    # extracted from Mandriva Linux Security Advisory MDVSA-2014:057. 
    # The text itself is copyright (C) Mandriva S.A.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(73004);
      script_version("1.7");
      script_cvs_date("Date: 2019/08/02 13:32:55");
    
      script_cve_id("CVE-2013-6451", "CVE-2013-6452", "CVE-2013-6453", "CVE-2013-6472", "CVE-2014-1610", "CVE-2014-2242", "CVE-2014-2243", "CVE-2014-2244");
      script_bugtraq_id(65003, 65223, 65883, 65906, 65910);
      script_xref(name:"MDVSA", value:"2014:057");
    
      script_name(english:"Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:057)");
      script_summary(english:"Checks rpm output for the updated packages");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Mandriva Linux host is missing one or more security
    updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "Updated mediawiki packages fix multiple vulnerabilities :
    
    MediaWiki user Michael M reported that the fix for CVE-2013-4568
    allowed insertion of escaped CSS values which could pass the CSS
    validation checks, resulting in XSS (CVE-2013-6451).
    
    Chris from RationalWiki reported that SVG files could be uploaded that
    include external stylesheets, which could lead to XSS when an XSL was
    used to include JavaScript (CVE-2013-6452).
    
    During internal review, it was discovered that MediaWiki's SVG
    sanitization could be bypassed when the XML was considered invalid
    (CVE-2013-6453).
    
    During internal review, it was discovered that MediaWiki displayed
    some information about deleted pages in the log API, enhanced
    RecentChanges, and user watchlists (CVE-2013-6472).
    
    Netanel Rubin from Check Point discovered a remote code execution
    vulnerability in MediaWiki's thumbnail generation for DjVu files.
    Internal review also discovered similar logic in the PdfHandler
    extension, which could be exploited in a similar way (CVE-2014-1610).
    
    MediaWiki before 1.22.3 does not block unsafe namespaces, such as a
    W3C XHTML namespace, in uploaded SVG files. Some client software may
    use these namespaces in a way that results in XSS. This was fixed by
    disallowing uploading SVG files using non-whitelisted namespaces
    (CVE-2014-2242).
    
    MediaWiki before 1.22.3 performs token comparison that may be
    vulnerable to timing attacks. This was fixed by making token
    comparison use constant time (CVE-2014-2243).
    
    MediaWiki before 1.22.3 could allow an attacker to perform XSS
    attacks, due to flaw with link handling in api.php. This was fixed
    such that it won't find links in the middle of api.php links
    (CVE-2014-2244).
    
    MediaWiki has been updated to version 1.22.3, which fixes these
    issues, as well as several others.
    
    Also, the mediawiki-ldapauthentication and mediawiki-math extensions
    have been updated to newer versions that are compatible with MediaWiki
    1.22.
    
    Additionally, the mediawiki-graphviz extension has been obsoleted, due
    to the fact that it is unmaintained upstream and is vulnerable to
    cross-site scripting attacks.
    
    Note: if you were using the instances feature in these packages to
    support multiple wiki instances, this feature has now been removed.
    You will need to maintain separate wiki instances manually."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://advisories.mageia.org/MGASA-2014-0113.html"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"http://advisories.mageia.org/MGASA-2014-0124.html"
      );
      script_set_attribute(attribute:"solution", value:"Update the affected packages.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"d2_elliot_name", value:"MediaWiki thumb.php page Parameter Remote Shell Command Injection");
      script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'MediaWiki Thumb.php Remote Command Execution');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mediawiki");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mediawiki-ldapauthentication");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mediawiki-mysql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mediawiki-pgsql");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:mandriva:linux:mediawiki-sqlite");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:mandriva:business_server:1");
    
      script_set_attribute(attribute:"patch_publication_date", value:"2014/03/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/14");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2014-2019 Tenable Network Security, Inc.");
      script_family(english:"Mandriva Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/Mandrake/release", "Host/Mandrake/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    if (!get_kb_item("Host/Mandrake/release")) audit(AUDIT_OS_NOT, "Mandriva / Mandake Linux");
    if (!get_kb_item("Host/Mandrake/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^(amd64|i[3-6]86|x86_64)$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Mandriva / Mandrake Linux", cpu);
    
    
    flag = 0;
    if (rpm_check(release:"MDK-MBS1", reference:"mediawiki-1.22.3-1.mbs1")) flag++;
    if (rpm_check(release:"MDK-MBS1", reference:"mediawiki-ldapauthentication-2.0f-1.mbs1")) flag++;
    if (rpm_check(release:"MDK-MBS1", reference:"mediawiki-mysql-1.22.3-1.mbs1")) flag++;
    if (rpm_check(release:"MDK-MBS1", reference:"mediawiki-pgsql-1.22.3-1.mbs1")) flag++;
    if (rpm_check(release:"MDK-MBS1", reference:"mediawiki-sqlite-1.22.3-1.mbs1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());
      else security_hole(0);
      exit(0);
    }
    else audit(AUDIT_HOST_NOT, "affected");
    
  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-2891.NASL
    descriptionThe remote Debian host is missing a security update. It is, therefore, affected by multiple vulnerabilities in MediaWiki : - A cross-site scripting (XSS) vulnerability exists due to a failure to validate input before returning it to the user. An unauthenticated, remote attacker can exploit this, via specially crafted SVG files, to execute arbitrary script code in the user
    last seen2020-03-17
    modified2014-03-31
    plugin id73256
    published2014-03-31
    reporterThis script is Copyright (C) 2014-2020 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/73256
    titleDebian DSA-2891-1 : mediawiki, mediawiki-extensions Multiple Vulnerabilities
    code
    #%NASL_MIN_LEVEL 80502
    #
    # (C) Tenable Network Security, Inc.
    #
    # The package checks in this plugin were
    # extracted from Debian Security Advisory DSA-2891
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(73256);
      script_version("1.15");
      script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/12");
    
      script_cve_id(
        "CVE-2013-2031",
        "CVE-2013-2032",
        "CVE-2013-4567",
        "CVE-2013-4568",
        "CVE-2013-4572",
        "CVE-2013-6452",
        "CVE-2013-6453",
        "CVE-2013-6454",
        "CVE-2013-6472",
        "CVE-2014-1610",
        "CVE-2014-2665"
      );
      script_bugtraq_id(
        59594,
        59595,
        63757,
        63760,
        63761,
        65003,
        65223,
        66600
      );
      script_xref(name:"DSA", value:"2891");
    
      script_name(english:"Debian DSA-2891-1 : mediawiki, mediawiki-extensions Multiple Vulnerabilities");
      script_summary(english:"Checks the dpkg output for the updated packages.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote Debian host is missing a security-related update.");
      script_set_attribute(attribute:"description", value:
    "The remote Debian host is missing a security update. It is, therefore,
    affected by multiple vulnerabilities in MediaWiki :
    
      - A cross-site scripting (XSS) vulnerability exists due to
        a failure to validate input before returning it to the
        user. An unauthenticated, remote attacker can exploit
        this, via specially crafted SVG files, to execute
        arbitrary script code in the user's browser session.
        (CVE-2013-2031)
    
      - A flaw exists in the password blocking mechanism due to
        two different tools being used to block password change
        requests, these being Special:PasswordReset and
        Special:ChangePassword, either of which may be bypassed
        by the method the other prevents. A remote attacker can
        exploit this issue to change passwords. (CVE-2013-2032)
    
      - Multiple flaws exist in Sanitizer::checkCss due to the
        improper sanitization of user-supplied input. An
        unauthenticated, remote attacker can exploit these to
        bypass the blacklist. (CVE-2013-4567, CVE-2013-4568)
    
      - A flaw exists due to multiple users being granted the
        same session ID within HTTP headers. A remote attacker
        can exploit this to authenticate as another random
        user. (CVE-2013-4572)
    
      - A cross-site scripting (XSS) vulnerability exists in the
        /includes/libs/XmlTypeCheck.php script due to improper
        validation of user-supplied input. An unauthenticated,
        remote attacker can exploit this, via a specially
        crafted XSL file, to execute arbitrary script code in
        the user's browser session. (CVE-2013-6452)
    
      - A flaw exists in the /includes/upload/UploadBase.php
        script due to a failure to apply SVG sanitization when
        XML files are read as invalid. An unauthenticated,
        remote attacker can exploit this to upload non-sanitized
        XML files, resulting in an unspecified impact.
        (CVE-2013-6453)
    
      - A stored cross-site (XSS) scripting vulnerability exists
        in the /includes/Sanitizer.php script due to a failure
        to properly validate the '-o-link' attribute before
        returning it to users. An unauthenticated, remote
        attacker can exploit this, via a specially crafted
        request, to execute arbitrary script code in the user's
        browser session. (CVE-2013-6454)
    
      - A flaw exists in the log API within the
        /includes/api/ApiQueryLogEvents.php script that allows
        an unauthenticated, remote attacker to disclose
        potentially sensitive information regarding deleted
        pages. (CVE-2013-6472)
    
      - Multiple flaws exist in the PdfHandler_body.php,
        DjVu.php, Bitmap.php, and ImageHandler.php scripts when
        DjVu or PDF file upload support is enabled due to
        improper sanitization of user-supplied input. An
        authenticated, remote attacker can exploit these, via
        the use of shell metacharacters, to execute execute
        arbitrary shell commands. (CVE-2014-1610)
    
      - A cross-site request forgery (XSRF) vulnerability exists
        in the includes/specials/SpecialChangePassword.php
        script due to a failure to properly handle a correctly
        authenticated but unintended login attempt. An
        unauthenticated, remote attacker, by convincing a user
        to follow a specially crafted link, can exploit this to
        reset the user's password. (CVE-2014-2665)");
      script_set_attribute(attribute:"see_also", value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=729629");
      script_set_attribute(attribute:"see_also", value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=706601");
      script_set_attribute(attribute:"see_also", value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742857");
      script_set_attribute(attribute:"see_also", value:"http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742857");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2031");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-2032");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-4567");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-4568");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-4572");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-6452");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-6453");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-6454");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2013-6472");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-1610");
      script_set_attribute(attribute:"see_also", value:"https://security-tracker.debian.org/tracker/CVE-2014-2665");
      script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/wheezy/mediawiki");
      script_set_attribute(attribute:"see_also", value:"https://packages.debian.org/source/wheezy/mediawiki-extensions");
      script_set_attribute(attribute:"see_also", value:"http://www.debian.org/security/2014/dsa-2891");
      script_set_attribute(attribute:"solution", value:
    "Upgrade the mediawiki packages. For the stable distribution (wheezy),
    these issues have been fixed in version 1:1.19.14+dfsg-0+deb7u1 of the
    mediawiki package and version 3.5~deb7u1 of the mediawiki-extensions
    package.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"d2_elliot_name", value:"MediaWiki thumb.php page Parameter Remote Shell Command Injection");
      script_set_attribute(attribute:"exploit_framework_d2_elliot", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'MediaWiki Thumb.php Remote Command Execution');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2014/03/30");
      script_set_attribute(attribute:"patch_publication_date", value:"2014/03/30");
      script_set_attribute(attribute:"plugin_publication_date", value:"2014/03/31");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mediawiki");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:mediawiki-extensions");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:7.0");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Debian Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2014-2020 Tenable Network Security, Inc.");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    include("audit.inc");
    include("debian_package.inc");
    include("misc_func.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    oslevel = get_kb_item("Host/Debian/release"); 
    if (empty_or_null(oslevel)) audit(AUDIT_OS_NOT, "Debian");
    if (oslevel !~ "^7\.") audit(AUDIT_OS_NOT, "Debian 7", "Debian " + oslevel);
    if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    
    flag = 0;
    if (deb_check(release:"7.0", prefix:"mediawiki", reference:"1:1.19.14+dfsg-0+deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions", reference:"3.5~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions-base", reference:"3.5~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions-collection", reference:"3.5~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions-geshi", reference:"3.5~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions-graphviz", reference:"3.5~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions-ldapauth", reference:"3.5~deb7u1")) flag++;
    if (deb_check(release:"7.0", prefix:"mediawiki-extensions-openid", reference:"3.5~deb7u1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        xss        : TRUE,
        xsrf       : TRUE,
        extra      : deb_report_get()
      );
    }
    else audit(AUDIT_HOST_NOT, "affected");