PT-2017-18043 · Enalean+1 · Tuleap+2

Ben Nott · Publicado 2017-04-29 · Atualizado 2019-10-03 · CVE-2017-7981

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 9.7 PhpWiki versions prior to 1.5.5

Description The issue allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin in the Project Wiki component. This occurs because the proc open PHP function is used with a syntax value in its first argument, which can be controlled by an authenticated Tuleap user, including shell metacharacters. For example, a line like '<?plugin SyntaxHighlighter syntax=c;id>' can be used to execute the id command.

Recommendations For Tuleap versions prior to 9.7, update to version 9.7 or later. For PhpWiki versions prior to 1.5.5, update to version 1.5.5 or later. As a temporary workaround, consider disabling the SyntaxHighlighter plugin until a patch is available.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2017-7981

Produtos afetados

Phpwiki

Syntaxhighlighter

Tuleap

Referências · 6

• 🔥 https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.md · Exploit
• 🔥 https://exploit-db.com/exploits/41953 · Exploit
• https://tuleap.net/plugins/tracker/?aid=10159 · Aviso do Fabricante
• https://tuleap.net/file/shownotes.php?release_id=137#/linked-artifacts · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-7981 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7981 · Aviso do Fabricante