Is CVE-2016-7998 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7998 being exploited in the wild.

How severe is CVE-2016-7998?

High severity, with a CVSS score of 8.8, published 18 January 2017.

Is there a fix for CVE-2016-7998?

A patch was published on 2016-09-27: Fixes committed to SPIP repository (revisions 23186, 23189, 23192) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7998 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2016-7998?

Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7998: SPIP remote PHP code execution in template compiler

CVE-2016-7998 · Severity: high · CVSS 8.8 · Published 2017-01-18

SPIP, a popular open-source content management system, contains a vulnerability that allows logged-in users to execute malicious code on the server. By uploading a specially crafted file and triggering a specific validation action, an attacker can take full control of the website and its underlying data. This could lead to a complete site takeover, data theft, or the use of the server for further attacks.

Technologies: Spip. Vendors: Spip.

Quick answers

Is CVE-2016-7998 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7998 being exploited in the wild.
How severe is CVE-2016-7998?: High severity, with a CVSS score of 8.8, published 18 January 2017.
Which products and versions are affected?: SPIP SPIP <= 3.1.2.
Is there a fix for CVE-2016-7998?: A patch was published on 2016-09-27: Fixes committed to SPIP repository (revisions 23186, 23189, 23192) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7998 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2016-7998?: Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A remote code execution vulnerability exists in the SPIP template compiler/composer (specifically in `ecrire/public/compiler.php`) due to improper input validation of file names. Authenticated users can exploit this by uploading an HTML file containing a crafted `INCLUDE` or `INCLURE` tag that includes double quotes to break out of the PHP string context during template compilation. When the file is subsequently accessed via the `valider_xml` action, the injected PHP code is executed on the server. The fix involves properly escaping double quotes in file names within the `calculer_inclure` function to prevent code injection.

Affected products

SPIP SPIP <= 3.1.2

Timeline

2016-09-27: patched: Fixes committed to SPIP repository (revisions 23186, 23189, 23192)
2016-10-05: disclosed: Vulnerability details shared on oss-security mailing list
2017-01-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.