Executive brief
wiki-plugin-datalog is a plugin for federated wiki that extends the markup language. A command injection vulnerability in the curl endpoint allows attackers to inject arbitrary commands and achieve remote code execution on systems running vulnerable versions. An attacker with network access can exploit this without authentication to gain full control of the affected server.
Technical details
The vulnerability is a command injection flaw (CWE-94) in the curl endpoint of wiki-plugin-datalog versions before 0.1.6. The package failed to properly sanitize user-supplied URLs passed to the curl endpoint, allowing attackers to inject shell commands. The attack vector is network-based with no authentication required and no user interaction needed. An attacker can achieve remote code execution on the server by crafting a malicious URL with embedded shell commands. The fix was implemented in version 0.1.6 by replacing the vulnerable curl implementation with fetch.
Affected products
- Ward Cunningham wiki-plugin-datalog < 0.1.6
Timeline
- 2019-06-05: disclosed
- 2019-06-13: patched: version 0.1.6 released with fix
- 2019-06-13: advisory