车东[Blog^2]

附：原邮件

Dear TWiki administrator,

This advisory alerts you of a potential security issue
with your TWiki installation: Unauthorized user may view
arbitrary files of the server file system with the
viewfile script.

NOTE: Please do not publicly announce until 2006-09-07,
but please feel free to forward this message to fellow
TWiki administrators.

* Vulnerable Software Version
* Attack Vectors
* Impact
* Severity Level
* MITRE Name for this Vulnerability
* Details
* Countermeasures
* Hotfix
* Authors and Credits
* Action Plan with Timeline
* Feedback
* External Links

---++ Vulnerable Software Version

* TWikiRelease04x00x04 -- TWiki-4.0.4.zip
* TWikiRelease04x00x03 -- TWiki-4.0.3.zip
* TWikiRelease04x00x02 -- TWiki-4.0.2.zip
* TWikiRelease04x00x01 -- TWiki-4.0.1.zip
* TWikiRelease04x00x00 -- TWiki-4.0.0.zip

---++ Attack Vectors

Supply a specially crafted HTTP POST request on the TWiki
viewfile script.

---++ Impact

An intruder is able to view arbitrary files on the server
file system that are readable by the webserver user, such
as user nobody or wwwrun. The server can potentially be
exploited by reading system files such as /etc/passwd.

---++ Severity Level

The TWiki SecurityTeam [2] triaged this issue as documented
in TWikiSecurityAlertProcess [3] and assigned the following
severity level:

* Severity 1 issue: The web server can be compromised

---++ MITRE Name for this Vulnerability

The Common Vulnerabilities and Exposures project has
assigned the name CVE-2006-4294 [4] to this vulnerability.

---++ Details

All TWiki 4.0.x releases do not sanitize the filename
parameter of the viewfile script. This can used to read
arbitrary files on the server. For example,
http://example.com/bin/viewfile/TWiki/TWikiDocGraphics?rev=1;filename=../../../../../etc/passwd
dispays the content of the =/etc/passwd= file in the
browser.

---++ Countermeasures

* Restrict access to the TWiki installation.
* Apply the hotfix indicated below.

NOTE: The hotfix is known to prevent the current attacks,
but it might not be a complete fix

---++ Hotfix

The accumulated Hotfix 3 for TWiki-4.0.4 contains an
improved version of the View.pm module, fixing the known
vulnerability. Hotfix 3 will be available at
http://twiki.org/cgi-bin/view/Codev/HotFix04x00x04x03 in
a few days.

If you prefer to fix your TWiki installation immediately,
add the line with "die" to the twiki/lib/TWiki/UI/View.pm
file:

Index: View.pm
===========================================================
--- View.pm (revision 11339)
+++ View.pm (working copy)
@@ -356,6 +356,7 @@
my $topic = $session->{topicName};

my $fileName = $query->param( 'filename' );
+ die "Illegal attachment name" if $fileName =~ m#[/\\]#;

my $rev = $session->{store}->cleanUpRevID( $query->param( 'rev' ) );

---++ Authors and Credits

* Credit to TWiki:Main.BenWheeler and
TWiki:Main.KoenMartens for disclosing the issue to
the twiki-security mailing list
* TWiki:Main.CrawfordCurrie for creating a fix
* TWiki:Main.KennethLavrsen for creating Hotfix 3 for
TWiki release 4.0.4
* TWiki:Main.PeterThoeny and TWiki:Main.KennethLavrsen
for creating the advisory

---++ Action Plan with Timeline

* 2006-08-20 and 08-28: User discloses vulnerability to
twiki-security
* 2006-08-22: Developer verifies issue
* 2006-08-22: Developer creates fix
* 2006-08-31: Security team creates advisory
* 2006-09-05: Send alert to twiki-announce mailing list
and twiki-dev mailing list
* 2006-09-06: Developer creates Hotfix 3 (pending)
* 2006-09-07: Publish advisory on TWiki.org (pending)
* 2006-09-07: Issue a public security advisory (pending)

---++ Feedback

Please provide feedback at the security alert topic [1],
http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-4294

---++ External Links

[1]: http://twiki.org/cgi-bin/view/Codev/SecurityAlert-CVE-2006-4294
[2]: http://twiki.org/cgi-bin/view/Codev/SecurityTeam
[3]: http://twiki.org/cgi-bin/view/Codev/TWikiSecurityAlertProcess
[4]: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4294
[5]: http://twiki.org/cgi-bin/view/Codev/TWikiRelease04x00x04
[6]: http://twiki.org/cgi-bin/view/Codev/HotFix04x00x04x03

-- __Contributors:__ PeterThoeny, CrawfordCurrie,
KennethLavrsen - 31 Aug 2006