CVE-2020-15275: malicious SVG attachment causing stored XSS vulnerability in MoinMoin
Impact An attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki.
Patches Users are strongly advised to upgrade to a patched version.
MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Workarounds It is not advised to work around this, but to upgrade MoinMoin to a patched version.
That said, a work around via a Content Security Policy in the web server might be possible.
Also, it is of course helpful if you give write permissions (which include uploading attachments) only to trusted users.
For more information If you have any questions or comments about this advisory, email me at twaldmann@thinkmo.de.
Credits
This vulnerability was discovered by:
Catarina Leite from the Checkmarx SCA AppSec team
Other sources
MoinMoin is a wiki engine. In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version. MoinMoin Wiki 1.9.11 has the necessary fixes and also contains other important fixes.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15275?
CVE-2020-15275 is classified as a high-severity vulnerability due to its potential for remote code execution via malicious SVG files.
How do I fix CVE-2020-15275?
To fix CVE-2020-15275, upgrade to version 1.9.9-1+deb10u1 for Debian or version 1.9.11 for pip installations of Moin.
What types of software are affected by CVE-2020-15275?
CVE-2020-15275 affects MoinMoin versions prior to 1.9.9-1+deb10u1 and 1.9.11 in pip installations.
What actions can an attacker take by exploiting CVE-2020-15275?
An attacker can upload an SVG file with malicious JavaScript that executes in users' browsers when viewing the file.
Who should be concerned about CVE-2020-15275?
Users and administrators of MoinMoin sites should be concerned about CVE-2020-15275, especially those with write permissions.