CVE-2022-29351
📋 TL;DR
CVE-2022-29351 is an arbitrary file upload vulnerability in TiddlyWiki5 v5.2.2 that allows attackers to upload malicious SVG files containing JavaScript code. When processed, this can lead to remote code execution on the server. All users running TiddlyWiki5 v5.2.2 with file upload functionality enabled are affected.
💻 Affected Systems
- TiddlyWiki5
📦 What is this software?
Tiddlywiki5 by Tiddlywiki
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise allowing attackers to execute arbitrary commands, access sensitive data, install malware, or pivot to other systems.
Likely Case
Server-side code execution leading to data theft, website defacement, or cryptocurrency mining malware installation.
If Mitigated
Limited impact with proper file upload restrictions, but potential for limited data exposure if other vulnerabilities exist.
🎯 Exploit Status
Proof of concept available on GitHub and YouTube demonstrating SVG file upload leading to code execution.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available as vendor disputes the vulnerability. Consider upgrading to latest version and implementing workarounds.
🔧 Temporary Workarounds
Disable file upload functionality
allRemove or disable the file upload module in TiddlyWiki5 configuration
Edit configuration to remove file upload capabilities
Implement strict file upload validation
allAdd server-side validation to reject SVG files or sanitize uploaded content
Implement file type validation and content scanning
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block malicious file uploads
- Restrict network access to TiddlyWiki5 instance and implement network segmentation
🔍 How to Verify
Check if Vulnerable:
Check if running TiddlyWiki5 v5.2.2 with file upload enabled. Test by attempting to upload a crafted SVG file.Check Version:
Check TiddlyWiki5 version in configuration or interfaceVerify Fix Applied:
Verify file upload restrictions are in place and test with malicious SVG files to ensure they are rejected.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads, especially SVG files with JavaScript content
- Server error logs showing file processing failures
Network Indicators:
- HTTP POST requests with SVG file uploads to TiddlyWiki5 endpoints
SIEM Query:
source="web_server" AND (method="POST" AND uri="/upload" AND file_extension="svg")🔗 References
- http://tiddlywiki5.com
- https://github.com/Jermolene/TiddlyWiki5
- https://github.com/jimcola99/corruptsvgfile
- https://www.youtube.com/watch?v=F_DBx4psWns
- http://tiddlywiki5.com
- https://github.com/Jermolene/TiddlyWiki5
- https://github.com/jimcola99/corruptsvgfile
- https://www.youtube.com/watch?v=F_DBx4psWns
