CVE-2020-19278
📋 TL;DR
CVE-2020-19278 is a Cross-Site Request Forgery (CSRF) vulnerability in Phachon mm-wiki v0.1.2 that allows attackers to trick authenticated users into executing unauthorized actions. This can lead to arbitrary code execution via the system/user/save parameter. Organizations running mm-wiki v0.1.2 are affected.
💻 Affected Systems
- Phachon mm-wiki
📦 What is this software?
Mm Wiki by Mm Wiki Project
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker gains full system control through arbitrary code execution, potentially compromising the entire server and data.
Likely Case
Attacker modifies user accounts, escalates privileges, or executes limited commands through authenticated user sessions.
If Mitigated
With proper CSRF protections, exploitation requires additional social engineering and may only affect individual user sessions.
🎯 Exploit Status
Exploitation requires tricking authenticated users into visiting malicious pages; proof-of-concept available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.1.3 or later
Vendor Advisory: https://github.com/phachon/mm-wiki/issues/68
Restart Required: Yes
Instructions:
1. Backup your mm-wiki data and configuration. 2. Download and install mm-wiki v0.1.3 or later from GitHub. 3. Replace the existing installation with the new version. 4. Restart the mm-wiki service.
🔧 Temporary Workarounds
Implement CSRF Tokens
allAdd CSRF protection tokens to all forms and validate them server-side.
Restrict Access
linuxLimit mm-wiki access to trusted networks using firewall rules.
iptables -A INPUT -p tcp --dport [mm-wiki-port] -s [trusted-ip-range] -j ACCEPT
iptables -A INPUT -p tcp --dport [mm-wiki-port] -j DROP
🧯 If You Can't Patch
- Deploy a web application firewall (WAF) with CSRF protection rules.
- Monitor and audit all user/save parameter requests for suspicious activity.
🔍 How to Verify
Check if Vulnerable:
Check mm-wiki version in admin panel or configuration files; if version is exactly 0.1.2, system is vulnerable.Check Version:
grep -r 'version' /path/to/mm-wiki/config/ or check web interface admin panelVerify Fix Applied:
Verify version is 0.1.3 or higher and test CSRF protection by attempting to submit forms without valid tokens.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to system/user/save from unusual IPs
- User account modifications without corresponding user actions
Network Indicators:
- Unusual HTTP POST traffic to system/user/save endpoint
- Requests lacking Referer headers or CSRF tokens
SIEM Query:
source="mm-wiki.log" AND (uri="/system/user/save" AND method="POST") | stats count by src_ip