PT-2017-18043 · Enalean+1 · Tuleap+2

Ben Nott · Published 2017-04-29 · Updated 2019-10-03 · CVE-2017-7981

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Tuleap versions prior to 9.7 PhpWiki versions prior to 1.5.5

Description The issue allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin in the Project Wiki component. This occurs because the proc open PHP function is used with a syntax value in its first argument, which can be controlled by an authenticated Tuleap user, including shell metacharacters. For example, a line like '<?plugin SyntaxHighlighter syntax=c;id>' can be used to execute the id command.

Recommendations For Tuleap versions prior to 9.7, update to version 9.7 or later. For PhpWiki versions prior to 1.5.5, update to version 1.5.5 or later. As a temporary workaround, consider disabling the SyntaxHighlighter plugin until a patch is available.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2017-7981

Affected Products

Phpwiki

Syntaxhighlighter

Tuleap

References · 6

• 🔥 https://github.com/xdrr/vulnerability-research/blob/master/webapp/tuleap/2017.04.tuleap-auth-ci.md · Exploit
• 🔥 https://exploit-db.com/exploits/41953 · Exploit
• https://tuleap.net/plugins/tracker/?aid=10159 · Vendor Advisory
• https://tuleap.net/file/shownotes.php?release_id=137#/linked-artifacts · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7981 · Security Note
• https://osv.dev/vulnerability/CVE-2017-7981 · Vendor Advisory