## commit spoofing
Anyone with direct commit access can forge "web commit from foo" and
-make it appear on [[RecentChanges]] like foo committed. One way to avoid
+make it appear on [[Json.tl.ph]] like foo committed. One way to avoid
this would be to limit web commits to those done by a certain user.
## other stuff to look at
The htmlscrubber did not block javascript in uris. This was fixed by adding
a whitelist of valid uri types, which does not include javascript.
-([[!cve CVE-2008-0809]]) Some urls specifyable by the meta plugin could also
+([[!debcve CVE-2008-0809]]) Some urls specifyable by the meta plugin could also
theoretically have been used to inject javascript; this was also blocked
-([[!cve CVE-2008-0808]]).
+([[!debcve CVE-2008-0808]]).
This hole was discovered on 10 February 2008 and fixed the same day
with the release of ikiwiki 2.31.1. (And a few subsequent versions..)
Cross Site Request Forging could be used to constuct a link that would
change a logged-in user's password or other preferences if they clicked on
the link. It could also be used to construct a link that would cause a wiki
-page to be modified by a logged-in user. ([[!cve CVE-2008-0165]])
+page to be modified by a logged-in user. ([[!debcve CVE-2008-0165]])
These holes were discovered on 10 April 2008 and fixed the same day with
the release of ikiwiki 2.42. A fix was also backported to Debian etch, as
This hole allowed ikiwiki to accept logins using empty passwords, to openid
accounts that didn't use a password. It was introduced in version 1.34, and
fixed in version 2.48. The [bug](http://bugs.debian.org/483770) was
-discovered on 30 May 2008 and fixed the same day. ([[!cve CVE-2008-0169]])
+discovered on 30 May 2008 and fixed the same day. ([[!debcve CVE-2008-0169]])
I recommend upgrading to 2.48 immediatly if your wiki allows both password
and openid logins.
enabling TeX configuration options that disallow unsafe TeX commands.
The fix was released on 30 Aug 2009 in version 3.1415926, and was
backported to stable in version 2.53.4. If you use the teximg plugin,
-I recommend upgrading. ([[!cve CVE-2009-2944]])
+I recommend upgrading. ([[!debcve CVE-2009-2944]])
## javascript insertion via svg uris
preview or moderation of comments with such a configuration.
These problems were discovered on 12 November 2010 and fixed the same
-hour with the release of ikiwiki 3.20101112. ([[!cve CVE-2010-1673]])
+hour with the release of ikiwiki 3.20101112. ([[!debcve CVE-2010-1673]])
## javascript insertion via insufficient checking in comments
This hole was discovered on 22 Jan 2011 and fixed the same day with
the release of ikiwiki 3.20110122. A fix was backported to Debian squeeze,
as version 3.20100815.5. An upgrade is recommended for sites
-with the comments plugin enabled. ([[!cve CVE-2011-0428]])
+with the comments plugin enabled. ([[!debcve CVE-2011-0428]])
## possible javascript insertion via insufficient htmlscrubbing of alternate stylesheets
the release of ikiwiki 3.20110328. A fix was backported to Debian squeeze,
as version 3.20100815.6. An upgrade is recommended for sites that have
untrusted committers, or have the attachments plugin enabled.
-([[!cve CVE-2011-1401]])
+([[!debcve CVE-2011-1401]])
## tty hijacking via ikiwiki-mass-rebuild
Ludwig Nussel discovered a way for users to hijack root's tty when
ikiwiki-mass-rebuild was run. Additionally, there was some potential
-for information disclosure via symlinks. ([[!cve CVE-2011-1408]])
+for information disclosure via symlinks. ([[!debcve CVE-2011-1408]])
This hole was discovered on 8 June 2011 and fixed the same day with
the release of ikiwiki 3.20110608. Note that the fix is dependant on
## javascript insertion via meta tags
Raúl Benencia discovered an additional XSS exposure in the meta plugin.
-([[!cve CVE-2012-0220]])
+([[!debcve CVE-2012-0220]])
This hole was discovered on 16 May 2012 and fixed the same day with
the release of ikiwiki 3.20120516. A fix was backported to Debian squeeze,
## XSS via openid selector
-Raghav Bisht discovered this XSS in the openid selector. ([[!cve CVE-2015-2793]])
+Raghav Bisht discovered this XSS in the openid selector. ([[!debcve CVE-2015-2793]])
The hole was reported on March 24th, a fix was developed on March 27th,
and the fixed version 3.20150329 was released on the 29th. A fix was backported
in progress.
An upgrade is recommended for sites using
-the CGI. ([[!cve CVE-2016-4561]], OVE-20160505-0012)
+the CGI. ([[!debcve CVE-2016-4561]], OVE-20160505-0012)
## ImageMagick CVE-2016–3714 ("ImageTragick")
ikiwiki 3.20160506 and 3.20141016.3 attempt to mitigate
-[[!cve CVE-2016-3714]], and any
+[[!debcve CVE-2016-3714]], and any
future ImageMagick vulnerabilities that resemble it, by restricting the
image formats that the [[ikiwiki/directive/img]] directive is willing to
resize. An upgrade is recommended for sites where an untrusted user is
## Perl CVE-2016-1238 (current working directory in search path)
-ikiwiki 3.20160728 attempts to mitigate [[!cve CVE-2016-1238]] by
+ikiwiki 3.20160728 attempts to mitigate [[!debcve CVE-2016-1238]] by
removing `'.'` from the Perl library search path. An attacker with write
access to ikiwiki's current working directory could potentially use this
vulnerability to execute arbitrary Perl code. An upgrade is recommended
This bug was reported on 2016-12-17. A partially fixed version
3.20161219 was released on 2016-12-19, but the solution used in that
version was not effective with git versions older than 2.8.0.
-A more complete fix was released on 2016-12-29 in version 3.20161229.
-A backport to Debian 8 'jessie' is in progress.
+A more complete fix was released on 2016-12-29 in version 3.20161229,
+with fixes backported to Debian 8 in version 3.20141016.4.
-([[!cve CVE-2016-10026]] represents the original vulnerability.
-[[!cve CVE-2016-9645]]/OVE-20161226-0002 represents the vulnerability
+([[!debcve CVE-2016-10026]] represents the original vulnerability.
+[[!debcve CVE-2016-9645]]/OVE-20161226-0002 represents the vulnerability
in 3.20161219 caused by the incomplete fix.)
## <span id="cve-2016-9646">Commit metadata forgery via CGI::FormBuilder context-dependent APIs</span>
could potentially forge commit authorship (attribute their edit to
someone else) by crafting multiple values for the rcsinfo field
-This was fixed in ikiwiki 3.20161229. A backport to Debian 8
-'jessie' is in progress.
+This was fixed in ikiwiki 3.20161229, with fixes backported to Debian 8
+in version 3.20141016.4.
-([[!cve CVE-2016-9646]]/OVE-20161226-0001)
+([[!debcve CVE-2016-9646]]/OVE-20161226-0001)
+
+## <span id="cve-2017-0356">Authentication bypass via repeated parameters</span>
+
+The ikiwiki maintainers discovered further flaws similar to CVE-2016-9646
+in the passwordauth plugin's use of CGI::FormBuilder, with a more
+serious impact:
+
+* An attacker who can log in to a site with a password can log in
+ as a different and potentially more privileged user.
+* An attacker who can create a new account can set arbitrary fields
+ in the user database for that account.
+
+This was fixed in ikiwiki 3.20170111, with fixes backported to Debian 8
+in version 3.20141016.4.
+
+([[!debcve CVE-2017-0356]]/OVE-20170111-0001)
+
+## <span id="cve-2019-9187">Server-side request forgery via aggregate plugin</span>
+
+The ikiwiki maintainers discovered that the [[plugins/aggregate]] plugin
+did not use [[!cpan LWPx::ParanoidAgent]]. On sites where the
+aggregate plugin is enabled, authorized wiki editors could tell ikiwiki
+to fetch potentially undesired URIs even if LWPx::ParanoidAgent was
+installed:
+
+* local files via `file:` URIs
+* other URI schemes that might be misused by attackers, such as `gopher:`
+* hosts that resolve to loopback IP addresses (127.x.x.x)
+* hosts that resolve to RFC 1918 IP addresses (192.168.x.x etc.)
+
+This could be used by an attacker to publish information that should not have
+been accessible, cause denial of service by requesting "tarpit" URIs that are
+slow to respond, or cause undesired side-effects if local web servers implement
+["unsafe"](https://tools.ietf.org/html/rfc7231#section-4.2.1) GET requests.
+([[!debcve CVE-2019-9187]])
+
+Additionally, if the LWPx::ParanoidAgent module was not installed, the
+[[plugins/blogspam]], [[plugins/openid]] and [[plugins/pinger]] plugins
+would fall back to [[!cpan LWP]], which is susceptible to similar attacks.
+This is unlikely to be a practical problem for the blogspam plugin because
+the URL it requests is under the control of the wiki administrator, but
+the openid plugin can request URLs controlled by unauthenticated remote
+users, and the pinger plugin can request URLs controlled by authorized
+wiki editors.
+
+This is addressed in ikiwiki 3.20190228 as follows, with the same fixes
+backported to Debian 9 in version 3.20170111.1:
+
+* URI schemes other than `http:` and `https:` are not accepted, preventing
+ access to `file:`, `gopher:`, etc.
+
+* If a proxy is [[configured in the ikiwiki setup file|tips/using_a_proxy]],
+ it is used for all outgoing `http:` and `https:` requests. In this case
+ the proxy is responsible for blocking any requests that are undesired,
+ including loopback or RFC 1918 addresses.
+
+* If a proxy is not configured, and LWPx::ParanoidAgent is installed,
+ it will be used. This prevents loopback and RFC 1918 IP addresses, and
+ sets a timeout to avoid denial of service via "tarpit" URIs.
+
+* Otherwise, the ordinary LWP user-agent will be used. This allows requests
+ to loopback and RFC 1918 IP addresses, and has less robust timeout
+ behaviour. We are not treating this as a vulnerability: if this
+ behaviour is not acceptable for your site, please make sure to install
+ LWPx::ParanoidAgent or disable the affected plugins.