Critical Foswiki Vulnerablities: A Logic Error Turned Remote Code Execution 

11. July 2023

Our Pentest Professionals at usd HeroLab love open source software as much as anyone. However, it should be secure as well. This is why Christian Pöschl, Senior Consultant IT Security at usd HeroLab, took a closer look at the open source software "Foswiki" in the context of our mission more security. He identified several vulnerabilities that allowed attackers to inject and execute malicious code remotely (remote code execution).

All vulnerabilities were reported to the developers according to our Responsible Disclosure Policy and were quickly fixed by the release of the TopicInteractionPlugin version 9.20.

Our Pentest Professionals wrote this blog to raise awareness of these attack vectors and to help other IT security professionals and system administrators to identify and fix these vulnerabilities.

A detailed description can be found in our LabNews: https://herolab.usd.de/en/critical-foswiki-vulnerablities-a-logic-error-turned-remote-code-execution/

More details about the identified vulnerabilities can be found here: https://herolab.usd.de/en/security-advisories/

Also interesting:

DORA Deep Dive: Threat-Led Penetration Testing (TLPT)

DORA Deep Dive: Threat-Led Penetration Testing (TLPT)

The Digital Operational Resilience Act (DORA) will apply as of January 17, 2025. In addition to routine operational resilience testing, DORA will also make it mandatory for certain financial companies to carry out threat-led penetration testing (TLPT) every three...

Security Advisory on Gambio

Security Advisory on Gambio

The pentest professionals at usd HeroLab examined the online shop software Gambio during their pentests. The software offers merchants various functions that support the management of inventory and orders. Our professionals discovered a vulnerability in the password...

Categories

Categories