CVE-2022-23375
📋 TL;DR
WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability where attackers can upload malicious files through the image upload form. This allows authenticated users to execute arbitrary code on the server. All installations running the vulnerable version are affected.
💻 Affected Systems
- WikiDocs
📦 What is this software?
Wikidocs by Wikidocs
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, steal data, install backdoors, or pivot to other systems.
Likely Case
Attacker gains shell access to the server, potentially compromising sensitive data and using the server for further attacks.
If Mitigated
Limited impact with proper file upload restrictions and server hardening, though risk remains if authentication is bypassed.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.1.19 or later
Vendor Advisory: https://github.com/Zavy86/WikiDocs/issues/28
Restart Required: No
Instructions:
1. Backup your WikiDocs installation and database. 2. Download the latest version from GitHub. 3. Replace the vulnerable files with the patched version. 4. Verify the upload functionality is properly restricted.
🔧 Temporary Workarounds
Disable image upload functionality
allTemporarily disable the image upload feature in index.php to prevent exploitation.
Edit index.php to remove or comment out image upload handling code
Implement file upload restrictions
allAdd server-side validation to restrict uploaded files to specific extensions and scan for malicious content.
Add file extension whitelisting and MIME type validation in upload handling code
🧯 If You Can't Patch
- Implement strict authentication controls and monitor for suspicious upload activity.
- Deploy a web application firewall (WAF) with rules to block malicious file uploads.
🔍 How to Verify
Check if Vulnerable:
Check if running WikiDocs version 0.1.18 by examining version files or configuration.Check Version:
Check the version in WikiDocs configuration files or admin panel.Verify Fix Applied:
Verify version is 0.1.19 or later and test that malicious file uploads are properly blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to image upload endpoint
- Files with suspicious extensions being uploaded
- Multiple failed upload attempts
Network Indicators:
- HTTP POST requests to upload endpoints with unusual file types
- Traffic patterns indicating file upload exploitation
SIEM Query:
source="web_server" AND (url="*upload*" OR url="*index.php*") AND (file_extension="php" OR file_extension="exe" OR file_extension="sh")