PT-2018-6688 · Andreas Gohr · Dokuwiki

Lc · Published 2018-02-03 · Updated 2018-07-07 · CVE-2017-18123

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: DokuWiki versions prior to 2017-02-19e

Description: The issue arises from the improper encoding of user input in the call parameter of the "/lib/exe/ajax.php" API endpoint. This leads to a reflected file download issue, allowing remote attackers to execute arbitrary programs.

Recommendations: For versions prior to 2017-02-19e, update to a version that properly encodes user input in the call parameter of the "/lib/exe/ajax.php" endpoint to prevent reflected file download attacks. As a temporary workaround, consider restricting access to the "/lib/exe/ajax.php" endpoint until a patch is available.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-18123

DLA-1269-1

DLA-1413-1

Affected Products

Dokuwiki

References · 20

• 🔥 https://github.com/splitbrain/dokuwiki/issues/2029 · Exploit
• 🔥 https://vulnhive.com/2018/000004 · Exploit
• https://github.com/splitbrain/dokuwiki/commit/238b8e878ad48f370903465192b57c2072f65d86 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-18123 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-18123 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18123 · Security Note
• https://osv.dev/vulnerability/CVE-2017-18123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18123 · Security Note
• https://security-tracker.debian.org/tracker/DLA-1413-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-18123 · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/dokuwiki · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-18123 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-18123 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1413-1 · Vendor Advisory
• https://github.com/splitbrain/dokuwiki/pull/2019 · Note