Penetration Test Report (iSEC): iSEC Wikimedia

Wikimedia Foundation
MediaWiki
Application Penetration Test
Prepared for:
Prepared by:
Valentin Leon — Security Engineer
David Thiel — Security Engineer
Justin Engler — Security Engineer
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page2of34
©2014,iSECPartners,Inc.
PreparedbyiSECPartners,Inc.forWikimediaFoundation.Portionsofthisdocumentandthetemplatesusedin
itsproductionarethepropertyofiSECPartners,Inc.andcannotbecopiedwithoutpermission.
Whileprecautionshavebeentakeninthepreparationofthisdocument,iSECPartners,Inc,thepublisher,andthe
author(s)assumenoresponsibilityforerrors,omissions,orfordamagesresultingfromtheuseoftheinformation
containedherein. UseofiSECPartnersservicesdoesnotguaranteethesecurityofasystem,orthatcomputer
intrusionswillnotoccur.
February13,2015 WikimediaFoundation Version1.1
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page3of34
DocumentChangeLog
Version Date Change
0.1 2014-12-26 Statusweek1.
1.0 2015-01-02 ReleaseforWikimediaFoundation.
1.1 2015-02-13 Publicrelease.
February13,2015 WikimediaFoundation Version1.1
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page4of34
Table of Contents
1 ExecutiveSummary ........................................................ 5
1.1 iSECRiskSummary ........................................................... 6
1.2 ProjectSummary ............................................................. 7
1.3 FindingsSummary............................................................ 8
1.4 RecommendationsSummary................................................... 9
2 EngagementStructure ..................................................... 11
2.1 InternalandExternalTeams ................................................... 11
2.2 ProjectGoalsandScope ....................................................... 12
3 DetailedFindings .......................................................... 14
3.1 Classifications................................................................ 14
3.2 Vulnerabilities ............................................................... 16
3.3 DetailedVulnerabilityList ..................................................... 17
Appendices .................................................................... 31
A WebApplicationTesting ................................................... 31
A.1 SSL/TLSConfigurationTesting ................................................. 31
February13,2015 WikimediaFoundation Version1.1
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page5of34
1 Executive Summary
ApplicationSummary
ApplicationName MediaWiki
ApplicationVersion 1.25
ApplicationType WebApplication
Platform PHP/Apache/MySQL
EngagementSummary
Dates December22,2014– January2,2015
ConsultantsEngaged Three
TotalEngagementEffort Sixpersonweeks
EngagementType ApplicationPenetrationTest
TestingMethodology WhiteBox
VulnerabilitySummary
TotalHighseverityissues 2
TotalMediumseverityissues 8
TotalLowseverityissues 2
TotalInformationalseverityissues 2
Totalvulnerabilitiesidentified: 14
Seesection3.1onpage14fordescriptionsoftheseclassifications.
CategoryBreakdown:
AccessControls 0
AuditingandLogging 0
Authentication 0
Configuration 3 (cid:4)(cid:4)(cid:4)
Cryptography 0
DataExposure 2 (cid:4)(cid:4)
DataValidation 7 (cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)(cid:4)
DenialofService 2 (cid:4)(cid:4)
ErrorReporting 0
Patching 0
SessionManagement 0
Timing 0
February13,2015 WikimediaFoundation Version1.1
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page6of34
1.1 iSEC Risk Summary
TheiSECPartnersRiskSummarychartevaluatesvulnerabilitiesaccordingtobusinessrisk.Theimpact
of the vulnerability increases towards the bottom of the chart. The sophistication required for an
attackertofindandexploittheflawdecreasestowardstheleftofthechart. Thecloseravulnerability
istothechartorigin,thegreaterthebusinessrisk.
• Users can inspect each other's
personal JavaScript
w
o
L
• Check User page lacks Cross Site
Request Forgery (CSRF) protection
k
s
i
R • Lack of upper limit on • Weak password policy
s password length allows DoS
s
e
n
i s • Stored XSS in SVG
u
B
• Denial of service attack in SVG • External reference
and XMP Metadata and XSS in PDF • Lack of registry lock on
domain names
• Custom JavaScript may yield
privilege escalation
h
g
iH
• External reference in SVG
• Reflected XSS in api.php
Simple Attack Sophistication Difficult
©2008 iSEC Partners, Inc.
February13,2015 WikimediaFoundation Version1.1
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page7of34
1.2 Project Summary
TheOpenTechnologyFund(OTF)engagediSECPartnerstoperformasource-codeassistedsecurity
review of Wikimedia Foundation MediaWiki. Testing included a web application assessment and
an external network audit. Three security consultants performed this review during the weeks of
December 22nd and December 29th for a total of six person-weeks of effort. This security analysis
wasstructuredas``besteffort''withinthegiventimeframe.
Theprimarygoalofthisengagementwastoidentifyvulnerabilitiesandgapsintheapplicationstack
andcodebase,specificallyfocusingonnewextensionsforthe1.25release.1 Asecondaryobjectivewas
torunanexternalnetworkscanontheWikimediaFoundation'spublicrangeofIPs.
iSECworkedcloselywiththeWikimediaFoundation(WMF)toperformthistestafterbeingintroduced
byOTF.TheWMFhelpedtomakethisengagementasuccessbyprovidingiSECsecurityengineerswith
allnecessaryitemsattheverybeginningoftheengagement: atestingenvironment,sourcecode,and
developerdocumentation. TheIPrangeswereprovidedontheseconddayoftheengagement.
MediaWikiisamatureapplicationthatevolvedthroughalonghistoryofpatchesandcoderewrites.
2 ManycontributorshelpedonthedesignandimplementationofMediaWiki'ssecurity. Thisimplies
thatmostofthefront-facingattacksurfaceshavealreadybeenreviewedforsecurityflaws,butthisalso
resultsinadisparatecodebase,duetothenumberofcodecontributors.
SeveralelementsofMediaWikiwereconsideredout-of-scopeforthisengagement:
• Dataexposureoftheusernames.
• Dataexposureofthepagecontent.
• NetworkbasedDenialofService(DoS).
Intermsofcoverage,thewebapplicationtestingwaspredominatelyfocusedontraditionalwebvul-
nerabilities such as cross-site request forgery (CSRF), cross-site scripting (XSS), and other types of
injections. iSECsecurityengineersfocusedtheirtestingontheeightareasofconcernsprioritizedby
theWMFdetailedinsection2.2onpage12.
iSECleveragedfuzzingtechniquesinthereviewofthewikitextparser. Fuzzingoftheparserdidnot
identifyvulnerabilitiesduringthelimiteddurationoftheengagement.SomedangerousPHPfunctions
werealsoidentifiedintheparsersectionbutnoneofthemappeartobeexploitable.
Asubstantialamountoftimewasspentreviewingtheupload,processinganddisplayofimagesand
files. iSECusedseveralattacktechniques,suchasinjectionandcompression,andmanuallyreviewed
thesourcecode. TheCheckUserextensionwasreviewedandfonudvulnerabletoCSRF.However,iSEC
wasunabletoidentifyanyareasofconcernaroundthevisualeditor;therequestforwardercodewas
properlyimplementedandinjectionattemptsintotheHTMLwereallpreventedwhenconvertingthe
codeintowikitext.
Parallel to the manual testing of the web application, iSEC performed a network assessment of the
publicIPrangeoftheWMF.ThefullIPv4rangewasscannedforvulnerabilities; becauseofthesize
oftheIPv6rangeprovided,onlyafractionofitwasscanned. Additionally,theDNSconfigurationwas
reviewedforvulnerabilities.
iSECalsoperformedanin-depthreviewoftheremainingextensions(namely,CentralAuth,Flow,Echo
andMediaViewer)butnovulnerabilitiesrelatedtothesecomponentswerefound.
1https://www.mediawiki.org/wiki/User:CSteipp_(WMF)/ISec_Audit
2http://www.aosabook.org/en/mediawiki.html
February13,2015 WikimediaFoundation Version1.1
iSECPartnersFinalReport—WikimediaFoundationMediaWiki Page8of34
1.3 Findings Summary
iSECidentifiedatotaloffourteenissues,includingtwoofhighseverity. Mostofthehighandmedium
severityvulnerabilitiesarerelatedtodatavalidationandallowforvariouscommonattacksincluding
XSS,DoS,andCSRF.
Oneoutofthetwohighseverityvulnerabilitiesandtwomediumseverityvulnerabilitiesallowcode
executionin