Last modified: 2014-02-12 23:32:45 UTC
The file maintenance/mwdoc-filter.php can be abused under certain server configurations to read the contents of arbitrary files. In case you - you have deleted the maintenance folder or - you have that folder denied in the server configuration or - the server is processing .htaccess overrides or - you are using PHP 5.4.0 (or later) or - you have register_globals disabled it is believed that you are not vulnerable. Explaining the conditions above: - MediaWiki bundles maintenance/.htaccess with 'Deny from all' - register_globals was removed in PHP 5.4.0 -If register_globals is disabled, register_argc_argv doesn't seem to make a difference. - If register_argc_argv is enabled, it overwrites the $argv from register globals to a single argument, so there's no $argv[1] to open... unless you use a + (no %20), so there are really two ways to exploit this, depending on register_argc_argv Verified with PHP 5.3.2 An insecure wrapper as mentioned in http://www.php.net/archive/2012.php#id2012-05-06-1 doesn't seem to allow splitting $argv into several items. mwdoc-filter.php is intended for usage by doxygen through the cli sapi, was added in ab59fadb https://gerrit.wikimedia.org/r/17192 and is present in 1.20 and master (git branch -a --contains ab59fadb)
Patchset for master on https://gerrit.wikimedia.org/r/50750 Backport for 1.20 on https://gerrit.wikimedia.org/r/50751
Thanks for the report and patch Platonides! This is confirmed. I think the likelihood that a configuration would be vulnerable is low, but the impact is high. We'll get this released as soon as possible. In the future, please do post patches to the bug instead of gerrit, so we can coordinate the release, if possible.
Released as part of 1.20.3
RedHat has assigned CVE-2013-1818 for this issue.
