CVE-2014-1610

MediaWiki <1.22.2/<1.21.5/<1.19.11 - RCE

Title source: llm

Description

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Exploits (3)

exploitdb WORKING POC VERIFIED

by Metasploit · rubyremotemultiple

https://www.exploit-db.com/exploits/31767

View Code ZIP pw:eip

exploitdb WORKING POC VERIFIED

by @u0x · textwebappsmultiple

https://www.exploit-db.com/exploits/31329

View Code ZIP pw:eip

metasploit WORKING POC EXCELLENT

by Netanel Rubin, Brandon Perry, Ben Harris, Ben Campbell · rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/mediawiki_thumb.rb

View Code ZIP pw:eip

References (19)

[Exploit, Third Party Advisory] http://www.exploit-db.com/exploits/31329/

[Various Sources] http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html

[Various Sources] http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html

[Issue Tracking] https://bugzilla.wikimedia.org/show_bug.cgi?id=60339

[Third Party Advisory] http://secunia.com/advisories/57472

[Various Sources] https://gerrit.wikimedia.org/r/#/c/110215/

[Third Party Advisory] http://www.debian.org/security/2014/dsa-2891

[Vendor Advisory] http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1029707

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/65223

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html

[Various Sources] https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php

[Third Party Advisory, VDB Entry] http://www.osvdb.org/102631

[Issue Tracking] https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff

[Issue Tracking] https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff

[Vendor Advisory] http://secunia.com/advisories/56695

[Vendor Advisory] https://gerrit.wikimedia.org/r/#/c/110069/

[Third Party Advisory, VDB Entry] http://osvdb.org/102630

[Mailing List, Third Party Advisory] http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html

Scores

EPSS 0.4804

EPSS Percentile 97.7%

Details

CWE

CWE-20

Status published

Products (17)

mediawiki/mediawiki 1.19.0

mediawiki/mediawiki 1.19.1

mediawiki/mediawiki 1.19.2

mediawiki/mediawiki 1.19.3

mediawiki/mediawiki 1.19.4

mediawiki/mediawiki 1.19.5

mediawiki/mediawiki 1.19.6

mediawiki/mediawiki 1.19.7

mediawiki/mediawiki 1.19.8

mediawiki/mediawiki 1.19.9

... and 7 more

Published Jan 30, 2014

Tracked Since Feb 18, 2026