Vulnerabilities > CVE-2017-0364 - Open Redirect vulnerability in multiple products

047910
CVSS 5.8 - MEDIUM
Attack vector
NETWORK
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
NONE

Summary

Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link.

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Fake the Source of Data
    An adversary provides data under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or it might be an attempt by the adversary to assume the rights granted to another identity. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

Nessus

NASL familyFedora Local Security Checks
NASL idFEDORA_2017-3FB95ED01F.NASL
description - (T109140) (T122209) Special:UserLogin and Special:Search allow redirect to interwiki links. (CVE-2017-0363, CVE-2017-0364) - (T144845) XSS in SearchHighlighter::highlightText() when $wgAdvancedSearchHighlighting is true. (CVE-2017-0365) - (T125177) API parameters may now be marked as
last seen2020-06-05
modified2017-04-17
plugin id99408
published2017-04-17
reporterThis script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/99408
titleFedora 25 : mediawiki (2017-3fb95ed01f)
code
#%NASL_MIN_LEVEL 80502
#
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Fedora Security Advisory FEDORA-2017-3fb95ed01f.
#

include("compat.inc");

if (description)
{
  script_id(99408);
  script_version("3.9");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/06/04");

  script_cve_id("CVE-2017-0361", "CVE-2017-0362", "CVE-2017-0363", "CVE-2017-0364", "CVE-2017-0365", "CVE-2017-0366", "CVE-2017-0367", "CVE-2017-0368", "CVE-2017-0369", "CVE-2017-0370", "CVE-2017-0372");
  script_xref(name:"FEDORA", value:"2017-3fb95ed01f");

  script_name(english:"Fedora 25 : mediawiki (2017-3fb95ed01f)");
  script_summary(english:"Checks rpm output for the updated package.");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Fedora host is missing a security update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"  - (T109140) (T122209) Special:UserLogin and Special:Search
    allow redirect to interwiki links. (CVE-2017-0363,
    CVE-2017-0364)

  - (T144845) XSS in SearchHighlighter::highlightText() when
    $wgAdvancedSearchHighlighting is true. (CVE-2017-0365)

  - (T125177) API parameters may now be marked as
    'sensitive' to keep their values out of the logs.
    (CVE-2017-0361)

  - (T150044) 'Mark all pages visited' on the watchlist now
    requires a CSRF token. (CVE-2017-0362)

  - (T156184) Escape content model/format url parameter in
    message. (CVE-2017-0368)

  - (T151735) SVG filter evasion using default attribute
    values in DTD declaration. (CVE-2017-0366)

  - (T48143) Spam blacklist ineffective on encoded URLs
    inside file inclusion syntax's link parameter.
    (CVE-2017-0370)

  - (T108138) Sysops can undelete pages, although the page
    is protected against it. (CVE-2017-0369)

The following only affects 1.27 and above and is not included in the
1.23 upgrade :

  - (T161453) LocalisationCache will no longer use the
    temporary directory in its fallback chain when trying to
    work out where to write the cache. (CVE-2017-0367)

The following fix is for the SyntaxHighlight extension :

  - (T158689) Parameters injection in SyntaxHighlight
    results in multiple vulnerabilities. (CVE-2017-0372)

Note that Tenable Network Security has extracted the preceding
description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as
possible without introducing additional issues."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://bodhi.fedoraproject.org/updates/FEDORA-2017-3fb95ed01f"
  );
  script_set_attribute(
    attribute:"solution", 
    value:"Update the affected mediawiki package."
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'MediaWiki SyntaxHighlight extension option injection vulnerability');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:fedoraproject:fedora:mediawiki");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:fedoraproject:fedora:25");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/13");
  script_set_attribute(attribute:"patch_publication_date", value:"2017/04/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2017/04/17");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Fedora Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/RedHat/release", "Host/RedHat/rpm-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("rpm.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
release = get_kb_item("Host/RedHat/release");
if (isnull(release) || "Fedora" >!< release) audit(AUDIT_OS_NOT, "Fedora");
os_ver = pregmatch(pattern: "Fedora.*release ([0-9]+)", string:release);
if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "Fedora");
os_ver = os_ver[1];
if (! preg(pattern:"^25([^0-9]|$)", string:os_ver)) audit(AUDIT_OS_NOT, "Fedora 25", "Fedora " + os_ver);

if (!get_kb_item("Host/RedHat/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


cpu = get_kb_item("Host/cpu");
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Fedora", cpu);


flag = 0;
if (rpm_check(release:"FC25", reference:"mediawiki-1.27.2-1.fc25")) flag++;


if (flag)
{
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "mediawiki");
}