Description
The history (revision control) function in TWiki 02-Sep-2004 and earlier allows remote attackers to execute arbitrary code via shell metacharacters, as demonstrated via the rev parameter to TWikiUsers.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
TWiki History Function Arbitrary Command Execution
exploit/unix/webapp/twiki_history
Exploit-DB 3
- TWiki History TWikiUsers - 'rev' Command Execution (Metasploit) EDB-16892 · webapps · Jul 3, 2010 · verified
- TWiki TWikiUsers - INCLUDE Function Arbitrary Command Execution EDB-26302 · webapps · Sep 28, 2005 · verified
- TWiki TWikiUsers - Arbitrary Command Execution EDB-26260 · webapps · Sep 14, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://twiki.org/cgi-bin/view/Codev/SecurityAlertExecuteCommandsWithRev
- 20050914 TWiki Remote Command Execution Vulnerability mailing-list
- VU#757181 third-party-advisory
- 14834 vdb-entry