Is CVE-2016-7999 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2016-7999 being exploited in the wild.

How severe is CVE-2016-7999?

High severity, with a CVSS score of 7.4, published 18 January 2017.

Is there a fix for CVE-2016-7999?

A patch was published on 2016-09-27: SPIP team corrected the vulnerability in repository revisions 23188 and 23193 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2016-7999 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2016-7999?

Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2016-7999: SPIP SSRF in valider_xml.php

CVE-2016-7999 · Severity: high · CVSS 7.4 · Published 2017-01-18

SPIP, a popular open-source content management system, is vulnerable to a security flaw in its XML validation component. An attacker can trick the server into making unauthorized network requests to internal or external systems. This could allow an attacker to bypass firewalls, scan internal networks, or interact with sensitive services that are not normally accessible from the internet.

Technologies: Spip. Vendors: Spip.

Quick answers

Is CVE-2016-7999 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2016-7999 being exploited in the wild.
How severe is CVE-2016-7999?: High severity, with a CVSS score of 7.4, published 18 January 2017.
Which products and versions are affected?: SPIP SPIP <= 3.1.2.
Is there a fix for CVE-2016-7999?: A patch was published on 2016-09-27: SPIP team corrected the vulnerability in repository revisions 23188 and 23193 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2016-7999 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2016-7999?: Check whether you run Spip. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in SPIP versions 3.1.2 and earlier within the `ecrire/exec/valider_xml.php` script. The vulnerability is caused by insufficient validation of the `var_url` parameter in the `valider_xml` action, which allows remote attackers to initiate HTTP or FTP requests from the server. Specifically, the `is_dir()` function and `recuperer_page()` are called on user-supplied URLs, enabling an attacker to probe internal network resources or bypass access controls. The fix involves rejecting URLs containing protocol delimiters like '://' to prevent outbound network traffic. This was patched in SPIP 3.1.3.

Affected products

SPIP SPIP <= 3.1.2

Timeline

2016-09-15: disclosed: Initial discovery by Sysdream Labs
2016-09-27: patched: SPIP team corrected the vulnerability in repository revisions 23188 and 23193
2016-09-30: patched: SPIP 3.1.3 released
2017-01-18: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.