Junglewise Threat Intelligence

CVE-2016-7982: SPIP directory traversal in valider_xml.php

CVE-2016-7982 · Severity: high · CVSS 7.5 · Published 2017-01-18

Technologies: Spip. Vendors: Spip.

Executive brief

SPIP, a popular open-source content management system, is vulnerable to a directory traversal flaw. This allows an attacker to remotely browse and list files on the server that should be private. Such information can be used to map out the server's file structure or identify sensitive configuration files, potentially leading to further system compromise.

Technical details

A directory traversal vulnerability exists in 'ecrire/exec/valider_xml.php' within SPIP versions up to and including 3.1.2. The 'var_url' parameter in the 'valider_xml' action does not sufficiently sanitize user input, allowing remote attackers to use path traversal sequences (e.g., '../') or PHP wrappers (e.g., 'file://') to enumerate files and directories on the host system. An attacker can specify a directory and file extension to receive a list of matching files in the response. The vulnerability was addressed in version 3.1.3 by restricting the execution of 'valider_xml' to webmasters, implementing CSRF tokens, and adding stricter path validation.

Affected products

  • SPIP SPIP <= 3.1.2

Timeline

  • 2016-09-15: other: Initial discovery
  • 2016-09-28: patched: Fixes issued in repository revision 23200
  • 2016-09-30: other: SPIP 3.1.3 released
  • 2017-01-18: advisory: NVD publication date

References

Related threats