Executive brief
SPIP, a popular open-source content management system, contains a vulnerability that allows logged-in users to execute malicious code on the server. By uploading a specially crafted file and triggering a specific validation action, an attacker can take full control of the website and its underlying data. This could lead to a complete site takeover, data theft, or the use of the server for further attacks.
Technical details
A remote code execution vulnerability exists in the SPIP template compiler/composer (specifically in `ecrire/public/compiler.php`) due to improper input validation of file names. Authenticated users can exploit this by uploading an HTML file containing a crafted `INCLUDE` or `INCLURE` tag that includes double quotes to break out of the PHP string context during template compilation. When the file is subsequently accessed via the `valider_xml` action, the injected PHP code is executed on the server. The fix involves properly escaping double quotes in file names within the `calculer_inclure` function to prevent code injection.
Affected products
- SPIP SPIP <= 3.1.2
Timeline
- 2016-09-27: patched: Fixes committed to SPIP repository (revisions 23186, 23189, 23192)
- 2016-10-05: disclosed: Vulnerability details shared on oss-security mailing list
- 2017-01-18: advisory: NVD publication date
References
- http://www.openwall.com/lists/oss-security/2016/10/05/17
- http://www.openwall.com/lists/oss-security/2016/10/07/5
- http://www.openwall.com/lists/oss-security/2016/10/08/6
- http://www.securityfocus.com/bid/93451
- https://core.spip.net/projects/spip/repository/revisions/23186
- https://core.spip.net/projects/spip/repository/revisions/23189
- https://core.spip.net/projects/spip/repository/revisions/23192