CVE-2023-29721
📋 TL;DR
SofaWiki versions up to 3.8.9 contain an unrestricted file upload vulnerability that allows attackers to upload malicious files and execute arbitrary commands on the server. This affects all deployments running vulnerable versions of SofaWiki, particularly those exposed to the internet. The vulnerability stems from insufficient validation of uploaded files.
💻 Affected Systems
- SofaWiki
📦 What is this software?
Sofawiki by Sofawiki Project
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with remote code execution, data theft, lateral movement, and persistent backdoor installation.
Likely Case
Webshell deployment leading to data exfiltration, defacement, or use as a pivot point for further attacks.
If Mitigated
Limited impact with proper file upload restrictions, web application firewalls, and network segmentation in place.
🎯 Exploit Status
Exploitation requires only web access to the upload functionality. Multiple public references demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > 3.8.9
Vendor Advisory: https://github.com/bellenuit/sofawiki/issues/27
Restart Required: Yes
Instructions:
1. Upgrade SofaWiki to version 3.9.0 or later. 2. Restart the web server/service. 3. Verify the fix by testing file upload functionality.
🔧 Temporary Workarounds
Disable file uploads
allTemporarily disable file upload functionality in SofaWiki configuration
Edit SofaWiki configuration to remove or restrict upload capabilities
Web Application Firewall rules
allBlock malicious file uploads at the WAF layer
Configure WAF to block uploads of executable files (PHP, JSP, ASP, etc.)
🧯 If You Can't Patch
- Implement strict file upload validation (whitelist allowed extensions, validate file content)
- Isolate SofaWiki instance in a segmented network with limited outbound access
🔍 How to Verify
Check if Vulnerable:
Check SofaWiki version in admin panel or configuration files. If version <= 3.8.9, system is vulnerable.Check Version:
Check SofaWiki admin interface or examine SofaWiki configuration files for version informationVerify Fix Applied:
After patching, attempt to upload a malicious file (in a controlled test) - should be rejected. Verify version > 3.8.9.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads (especially executable files)
- Webshell access patterns
- Command execution attempts in web logs
Network Indicators:
- Outbound connections from web server to suspicious IPs
- Unusual traffic patterns from SofaWiki instance
SIEM Query:
source="sofawiki" AND (event="file_upload" AND file_extension IN ("php", "jsp", "asp", "aspx")) OR (event="command_execution")