CVE-2017-1000497
📋 TL;DR
Pepperminty-Wiki 0.15 contains an XML External Entity (XXE) vulnerability in the getsvgsize function that allows attackers to read arbitrary files from the server filesystem and potentially execute remote code. This affects all installations running the vulnerable version. The vulnerability can be exploited by uploading malicious SVG files containing XXE payloads.
💻 Affected Systems
- Pepperminty-Wiki
📦 What is this software?
Pepperminty Wiki by Pepperminty Wiki Project
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, and persistent backdoor installation.
Likely Case
Denial of service through resource exhaustion and sensitive file disclosure (configuration files, credentials, etc.).
If Mitigated
Limited impact with proper input validation and XML parser configuration.
🎯 Exploit Status
The vulnerability is well-documented in the GitHub issue with proof-of-concept examples showing file disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 0.16 and later
Vendor Advisory: https://github.com/sbrl/Pepperminty-Wiki/issues/152
Restart Required: No
Instructions:
1. Backup your wiki data. 2. Download Pepperminty-Wiki 0.16 or later from GitHub. 3. Replace the existing installation files with the new version. 4. Verify the getsvgsize function no longer uses vulnerable XML parsing.
🔧 Temporary Workarounds
Disable SVG upload functionality
allTemporarily disable SVG file uploads in the wiki configuration to prevent exploitation.
Edit config.php and set 'allow_svg_uploads' to false if available
Configure PHP XML parser securely
allDisable external entity loading in PHP's XML parser configuration.
libxml_disable_entity_loader(true); in PHP code before XML parsing
🧯 If You Can't Patch
- Implement strict file upload validation to reject SVG files containing XML entities
- Deploy a web application firewall (WAF) with XXE protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running Pepperminty-Wiki version 0.15 by examining the version file or checking the wiki footer.Check Version:
Check the VERSION file in the wiki root directory or view the wiki footer in a browser.Verify Fix Applied:
Verify the installation is version 0.16 or later and test SVG upload functionality with XXE payloads to confirm they're blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SVG file uploads
- Large XML parsing errors in PHP logs
- File read attempts via XXE payloads
Network Indicators:
- HTTP POST requests with SVG files containing XML entity declarations
- Outbound connections initiated by the web server after SVG upload
SIEM Query:
source="web_server_logs" AND (uri_path="*upload*" OR method="POST") AND user_agent="*SVG*" AND (status="200" OR status="500")