SyntaxHighlight MediaWiki extension allows injection of arbitrary
Pygments options
------------------------------
Yorick Koster, February 2017
------------------------------
Abstract
------------------------------
A vulnerability was found in the SyntaxHighlight MediaWiki extension.
Using this vulnerability it is possible for an anonymous attacker to
pass arbitrary options to the Pygments library. By specifying specially
crafted options, it is possible for an attacker to trigger a (stored)
Cross-Site Scripting condition. In addition, it allows the creating of
arbitrary files containing user-controllable data. Depending on the
server configuration, this can be used by an anonymous attacker to
execute arbitrary PHP code.
------------------------------
See also
------------------------------
- CVE-2017-0372
- https://phabricator.wikimedia.
- https://lists.wikimedia.org/pi
------------------------------
Tested versions
------------------------------
This issue was tested on SyntaxHighlight version 2.0 as bundled with
MediaWiki version 1.28.0.
------------------------------
Fix
------------------------------
This issue was supposed to be fixed in MediaWiki version 1.28.1 and
version 1.27.2. It appears that the fix was pushed to the git
repository, but for some reason it was not included in the release
packages. It is advised to apply the patch committed to Github.
https://github.com/wikimedia/m
https://github.com/wikimedia/m
------------------------------
Details
------------------------------
https://www.securify.nl/adviso
Komentarų nėra:
Rašyti komentarą