MediaWiki CVE-2011-0537 Language File Path Traversal Vulnerability

Key Information Vulnerability Type: Language file path traversal Status: Closed, Resolved Creator: tstirling Creation Date: Feb 1 2011, 10:13 PM Tags: - MediaWiki-Internationalization (Backlog) - Security Reference File: wikibugs-l-list Version: 1.16.x Severity: critical Vulnerability Description A path traversal vulnerability was discovered in the Language class of MediaWiki by developer Happy Melon, allowing execution of any PHP script ending in ".php" located in the same drive path. Due to differences in the implementation of across platforms, systems based on Linux and Mac OS X are unaffected. Windows is known to be vulnerable, but Novell Netware has not been tested and may also be affected. The requirement for files to end in ".php" is an important mitigating factor. In MediaWiki, all ".php" files are considered executable, so measures must be taken to prevent significant operations from being performed solely through execution. Therefore, as with other web applications, uploading files ending in ".php" should not be allowed. Exploiting this vulnerability also requires additional software on the server, such as: A web application that allows uploading of ".php" files (not yet identified). Special maintenance scripts known to the attacker, or accessible via other vulnerabilities on the server. Any process that places user input into C:\WINDOWS\Temp and ends with ".php". The fix will be released in MediaWiki 1.16.2. If patches are available for earlier major versions, they will be noted in the comments below. All MediaWiki installations from version 1.8.x should be patched or upgraded. The vulnerability occurs when is called with unvalidated user input, and has existed since version 1.12.0; vulnerable extensions may have been affected even earlier. Our fix throws an exception when is called with invalid input. Extension developers should validate user input by calling the newly introduced or by checking against the list of language codes returned by , to provide more appropriate error messages to users. Additional Information CVE ID: CVE-2011-0537

Goal Reached Thanks to every supporter — we hit 100%!

MediaWiki CVE-2011-0537 Language File Path Traversal Vulnerability