Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

The remote host is affected by the vulnerability described in GLSA-201309-14 (MoinMoin: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MoinMoin. Please review       the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, overwrite arbitrary files, or conduct       Cross-Site Scripting (XSS) attacks.
  Workaround :

    There is no known workaround at this time.

According to its version number, the MoinMoin install hosted on the remote web server is affected by multiple vulnerabilities:

  - Versions 1.9.3 up to 1.9.5 are affected by a directory     traversal vulnerability because the _do_attachment_move     action in 'AttachFile.py' does not properly sanitize     user-supplied input.  This could allow an     unauthenticated, remote attacker to upload and     overwrite arbitrary files on the remote host.
    (CVE-2012-6080)

  - Versions 1.9.x up to 1.9.5 are affected by a remote     code execution vulnerability because the 'twikidraw.py'     action fails to properly sanitize user-supplied input.
    A remote, unauthenticated attacker could utilize a     specially crafted request using directory traversal     style characters to upload a file containing arbitrary     code to the remote host.  An attacker could then execute     the code with the privileges of the user that runs the     MoinMoin process.  (CVE-2012-6081)

  - Version 1.9.5 is affected by a cross-site scripting     (XSS) vulnerability because the application fails to     properly sanitize user-supplied input in the 'page_name'     parameter when creating an rss link.  An attacker could     leverage this issue to inject arbitrary HTML and script     code into a user's browser to be executed within the     security context of the affected site.  (CVE-2012-6082)

  - Versions < 1.9.x are not maintained by MoinMoin     developers and should be considered vulnerable.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Update to 1.9.6. Fixes CVE-2012-6495 

For full changes, see :

http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The MoinMoin install hosted on the remote web server fails to properly sanitize user-supplied input in the twikidraw (action/twikidraw.py) action.  A remote, unauthenticated attacker could utilize a specially crafted request using directory traversal style characters to upload a file containing arbitrary code to the remote host.  An attacker could then execute the code with the privileges of the user that runs the MoinMoin process.  Successful exploitation requires that the MoinMoin plugin directory has write permission set for the MoinMoin server user. 

Note that the 'anywikidraw' action is reportedly also affected by the directory traversal and code execution vulnerabilities.  The application is also reportedly affected by an additional directory traversal vulnerability in the action/AttachFile.py script (CVE-2012-6080) as well as a cross-site scripting (XSS) vulnerability when creating an rss link (CVE-2012-6082).  Nessus has not, however, tested for these additional issues.

Update to 1.9.6. Fixes CVE-2012-6495

For full changes, see :

http://hg.moinmo.in/moin/1.9/raw-file/1.9.6/docs/CHANGES

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MoinMoin developers report the following vulnerabilities as fixed in version 1.9.6 :

- remote code execution vulnerability in twikidraw/anywikidraw action,

- path traversal vulnerability in AttachFile action,

- XSS issue, escape page name in rss link.

CVE entries at MITRE furher clarify :

Multiple unrestricted file upload vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in an unspecified directory, as exploited in the wild in July 2012.

Directory traversal vulnerability in the _do_attachment_move function in the AttachFile action (action/AttachFile.py) in MoinMoin 1.9.3 through 1.9.5 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in a file name.

Cross-site scripting (XSS) vulnerability in the rsslink function in theme/__init__.py in MoinMoin 1.9.5 allows remote attackers to inject arbitrary web script or HTML via the page name in a rss link.

It was discovered that missing input validation in the twikidraw and anywikidraw actions can result in the execution of arbitrary code.
This security issue is being actively exploited.

This update also addresses path traversal in AttachFile.

ID	Name	Product	Family	Severity
70110	GLSA-201309-14 : MoinMoin: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
64930	MoinMoin < 1.9.6 Multiple Vulnerabilities	Nessus	CGI abuses	medium
63656	Fedora 17 : moin-1.9.6-1.fc17 (2013-0685)	Nessus	Fedora Local Security Checks	medium
63655	Fedora 16 : moin-1.9.6-1.fc16 (2013-0640)	Nessus	Fedora Local Security Checks	medium
63638	MoinMoin twikidraw.py Traversal File Upload Arbitrary File Overwrite	Nessus	CGI abuses	high
63636	Fedora 18 : moin-1.9.6-1.fc18 (2013-0600)	Nessus	Fedora Local Security Checks	medium
63397	FreeBSD : moinmoin -- Multiple vulnerabilities (a264b1b0-5726-11e2-9483-14dae938ec40)	Nessus	FreeBSD Local Security Checks	medium
63356	Debian DSA-2593-1 : moin - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-6081

medium

Tenable Plugins

medium

medium

medium

medium

high

medium

medium

medium