Directory traversal vulnerability in the ACL Manager plugin (plugins/acl/ajax.php) in DokuWiki before 2009-12-25b allows remote attackers to list the contents of arbitrary directories via a .. (dot dot) in the ns parameter.

The remote host is affected by the vulnerability described in GLSA-201301-07 (DokuWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in DokuWiki. Please review       the CVE identifiers referenced below for details.
  Impact :

    The vulnerabilities might allow an attacker to disclose local files, to       inject arbitrary web script, or to gain elevated privileges in the       DokuWiki application.
  Workaround :

    There is no known workaround at this time.

- Fix CSRF bug Secunia advisory SA38205, dokuwiki bug     #1853 http://secunia.com/advisories/38205/3/ - Fix     Security ACL bypass bug Secunia advisory SA38183,     dokuwiki bug #1847     http://secunia.com/advisories/38183/3/

  - Upgrade to the latest upstream - Fix bugzilla bug     #556494

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in dokuwiki, a standards compliant simple to use wiki. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2010-0287     It was discovered that an internal variable is not     properly sanitized before being used to list     directories. This can be exploited to list contents of     arbitrary directories.

  - CVE-2010-0288     It was discovered that the ACL Manager plugin doesn't     properly check the administrator permissions. This allow     an attacker to introduce arbitrary ACL rules and thus     gaining access to a closed Wiki.

  - CVE-2010-0289     It was discovered that the ACL Manager plugin doesn't     have protections against cross-site request forgeries     (CSRF). This can be exploited to change the access     control rules by tricking a logged in administrator into     visiting a malicious website.

The oldstable distribution (etch) is not affected by these problems.

Dokuwiki reports :

The plugin does no checks against cross-site request forgeries (CSRF) which can be exploited to e.g. change the access control rules by tricking a logged in administrator into visiting a malicious website.

The bug allows listing the names of arbitrary file on the webserver - not their contents. This could leak private information about wiki pages and server structure.

The remote web server is hosting a release of DokuWiki earlier than DokuWiki 2009-12-25.  Such versions are potentially affected by multiple vulnerabilities : 

  - A security-bypass vulnerability that can be exploited through the 'cmd[save]', 'cmd[del]', and 'cmd[update]' parameters of the 'lib/plugins/acl/ajax.php' script.

  - An information-disclosure vulnerability in the 'ns' parameter of the 'ajax.php' script.

ID	Name	Product	Family	Severity
63441	GLSA-201301-07 : DokuWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
47197	Fedora 12 : dokuwiki-0-0.4.20091225.c.fc12 (2010-0800)	Nessus	Fedora Local Security Checks	high
47196	Fedora 11 : dokuwiki-0-0.4.20091225.c.fc11 (2010-0770)	Nessus	Fedora Local Security Checks	high
44840	Debian DSA-1976-1 : dokuwiki - several vulnerabilities	Nessus	Debian Local Security Checks	high
44049	FreeBSD : dokuwiki -- multiple vulnerabilities (848539dc-0458-11df-8dd7-002170daae37)	Nessus	FreeBSD Local Security Checks	high
5302	DokuWiki < DokuWiki Release 2009-12-25 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium

Detections

Analytics

CVE-2010-0287

high

Tenable Plugins

high

high

high

high

high

medium