Serious RCE flaw discovered in Wiki architecture

News by Steve Gold

A critical vulnerability has been discovered in the open source software architecture that drives Wikipedia and numerous other `Wiki' information services.

A critical vulnerability has been discovered in the open source software architecture that drives Wikipedia and numerous other `Wiki' information services, including Intellipedia – the US Intelligence Community Wiki systems - and internal systems used by Intel and Novell.

The potentially serious flaw lies in the MediaWiki project Web platform, which runs many thousands of public and private sector wiki-based systems, including the infamous Wikileaks service.

According to Check Point, whose research team discovered the issue, the vulnerability makes a Wiki system open to remote code execution (RCE), meaning an attacker can gain complete control of the vulnerable Web server.

News of the discovered has been welcomed by the security community, with Quocirca director and analyst Bob Tarzey telling that there are plenty of reasons why cyber criminals and hacktivists might want to undermine Wikipedia or other wiki-based platforms.

"Nation states might like to have had a crack at Wikileaks at its height too. This news reminds us of two things: firstly that any platform can be vulnerable, and secondly, that the security industry can keep ahead of the attackers and pre-empt possible attacks by discovering vulnerabilities like this," he said.

Check Point says it alerted the WikiMedia Foundation about the vulnerability as soon it was discovered, and after verification, the Foundation issued an update and patch to the software.

Dorit Dor, the firm's vice president of products, says that, if the vulnerability had not been uncovered, an attacker would have been able to control the web server or any other ‘wiki' site running on MediaWiki - and potentially serve up malware to site visitors.

“It only takes a single vulnerability on a widely adopted platform [like this] for a hacker to infiltrate and wreak widespread damage,” she said.

"We're pleased that the MediaWiki platform is now protected against attacks on this vulnerability, which would have posed great security risk for millions of daily ‘wiki' site users,” she added.

This is believed to be the only the third RCE vulnerability found in the MediaWiki platform since 2006, when parsing functions were added to the software platform.

Commenting on the security flaw, Professor John Walker, a Visiting Professor with the Nottingham-Trent University Faculty of Engineering, said that businesses are increasingly being driven to deliver the latest and greatest technologies to their customers.

"However, once again, we see the complex and advanced code in these systems falling to the world of hacking," he said, adding that the common trend - which hackers and cyber criminals exploit for gain - includes vulnerabilities, exposures, and unauthorised incursions into the heart of the systems involved.

Professor Walker - who is also CTO of IT security consultancy Integral Security Xssurance - added that, now that the patch has been issued, the underlying issue will soon be forgotten.

"Taken in isolation, there regular reports of insecurity issues may seem insignificant. But taken as a whole the implications are clear: it is time to change our approach to security.”

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews