TWiki 'debugenableplugins' Parameter Remote Code Execution Vulnerability

Bugtraq ID:	70372
Class:	Input Validation Error
CVE:	CVE-2014-7236
Remote:	Yes
Local:	No
Published:	Oct 09 2014 12:00AM
Updated:	Oct 09 2014 12:00AM
Credit:	Netanel Rubin
Vulnerable:	TWiki TWiki 6.0 TWiki TWiki 5.1.4 TWiki TWiki 5.1.3 TWiki TWiki 5.1 TWiki TWiki 5.0.2 TWiki TWiki 5.0.1 TWiki TWiki 5.0 TWiki TWiki 4.3.2 TWiki TWiki 4.3.1 TWiki TWiki 4.3 TWiki TWiki 4.2.4 TWiki TWiki 4.2.3 TWiki TWiki 4.2.2 TWiki TWiki 4.2.1 TWiki TWiki 4.2 TWiki TWiki 4.1.2 TWiki TWiki 4.1.1 TWiki TWiki 4.1 TWiki TWiki 4.0.5 TWiki TWiki 4.0.4 TWiki TWiki 4.0.3 TWiki TWiki 4.0.2 TWiki TWiki 4.0.1 TWiki TWiki 5.1.2 TWiki TWiki 5.1.1 TWiki TWiki 4
Not Vulnerable:	TWiki TWiki 6.0.1

TWiki 'debugenableplugins' Parameter Remote Code Execution Vulnerability

TWiki is prone to remote code-execution vulnerability.

Attackers can exploit this issue to execute arbitrary code in the context of the webserver user.

The following versions are affected:

TWiki 6.0.0
TWiki 5.1.0 through TWiki 5.1.4
TWiki 5.0.0 through TWiki 5.0.2
TWiki 4.3.0 through TWiki 4.3.2
TWiki 4.2.0 through TWiki 4.2.4
TWiki 4.1.0 through TWiki 4.1.2
TWiki 4.0.0 through TWiki 4.0.5

TWiki 'debugenableplugins' Parameter Remote Code Execution Vulnerability

An attacker can exploit this issue using a web browser.

The following example URI is available:

http://www.example.com/do/view/Main/WebHome?debugenableplugins=BackupRestorePlugin%3bprint("Content-Type:text/html\r\n\r\nVulnerable!")%3bexit

TWiki 'debugenableplugins' Parameter Remote Code Execution Vulnerability

References:

• TWiki Homepage (TWiki)
  
• CVE-2014-7236: Remote Perl code execution with query string to debug TWiki plugi (TWiki)