mailing list archives
STG Security Advisory: [SSA-20041215-19] Vulnerability of uploading files with multiple extensions in MediaWiki
From: <advisory () stgsecurity com>
Date: 16 Dec 2004 02:43:12 -0000
STG Security Advisory: [SSA-20041215-19] Vulnerability of uploading files
with multiple extensions in MediaWiki
Date Published: 2004-12-15 (KST)
Last Update: 2004-12-15 (KST)
Disclosed by SSR Team (advisory () stgsecurity com)
MediaWiki is one of famous wiki web applications. However, an input
validation flaw can cause malicious attackers to run arbitrary commands with
the privilege of the HTTPD process, which is typically run as the nobody
Implementation Error: Input validation flaw
High : arbitrary command execution.
MediaWiki 1.3.8 and prior.
Vendor Status: FIXED
2004-12-10 Vulnerability found.
2004-12-10 MediaWiki developer notified.
2004-12-13 Update version released.
2004-12-15 Official release.
MediaWiki doesn't implemented to check multiple extensions of uploaded
files, e.g. attack.php.rar, so malicious attackers can upload arbitrary
script files (php, pl, cgi, etc) to a web server. This is originated from a
feature of Apache MIME module (mod_mime), which regards attack.php.rar as a
normal PHP file and execute the file through mod_php module with the
privilege of the HTTPD process.
cf. http://httpd.apache.org/docs/mod/mod_mime.html - "Files with Multiple
Extensions" : it's a feature, not a bug.
Update to 1.3.9
Jeremy Bae at STG Security
- STG Security Advisory: [SSA-20041215-19] Vulnerability of uploading files with multiple extensions in MediaWiki advisory (Dec 16)