CVE-2020-27191
📋 TL;DR
CVE-2020-27191 is a Local File Inclusion vulnerability in LionWiki that allows unauthenticated attackers to read arbitrary files on the server by manipulating the 'f1' parameter in index.php. This affects all LionWiki installations before version 3.2.12. Note that LionWiki is no longer maintained by its original developer.
💻 Affected Systems
- LionWiki
📦 What is this software?
Lionwiki by Lionwiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive files like configuration files, password files, or source code, potentially leading to credential theft, privilege escalation, or further system compromise.
Likely Case
Unauthenticated attackers reading web server accessible files, potentially exposing configuration details, user data, or application source code.
If Mitigated
If proper web application firewalls and file permission controls are in place, impact is limited to reading only files accessible to the web server user.
🎯 Exploit Status
Exploitation requires only HTTP requests with crafted parameters. Public proof-of-concept code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.2.12
Vendor Advisory: http://lionwiki.0o.cz/index.php?page=Main+page
Restart Required: No
Instructions:
1. Download LionWiki 3.2.12 or later from the official website. 2. Backup your current installation. 3. Replace all files with the new version. 4. Verify functionality.
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation to reject or sanitize the f1 parameter containing directory traversal sequences
Modify index.php to validate the f1 parameter before processing
Web Application Firewall Rule
allBlock requests containing directory traversal patterns in the f1 parameter
Add WAF rule to block requests with '../', '..\', or similar patterns in f1 parameter
🧯 If You Can't Patch
- Implement strict file permissions to limit web server user access to sensitive files
- Deploy a web application firewall with rules to detect and block LFI exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Test by accessing index.php?f1=../../../../etc/passwd (or similar local file path) and checking if file contents are returnedCheck Version:
Check the version number in the LionWiki installation files or admin interfaceVerify Fix Applied:
After patching, attempt the same LFI test and verify file contents are not returned📡 Detection & Monitoring
Log Indicators:
- HTTP requests with f1 parameter containing '../' or similar directory traversal patterns
- Unusual file access patterns from web server process
Network Indicators:
- HTTP requests with f1 parameter attempting directory traversal
SIEM Query:
web.url:*f1=*..* OR web.uri:*f1=*..*