CVE-2024-33103

Executive Summary

CVE-2024-33103 is an arbitrary file upload vulnerability in the Media Manager component of DokuWiki version 2024-02-06a. The vulnerability allows an authenticated attacker to upload a crafted SVG file that can execute arbitrary code on the server. The issue stems from insufficient validation of SVG file contents, enabling XML External Entity (XXE) injection or JavaScript execution within the SVG context. While the official description notes that exploitability may require a misconfiguration, the risk is significant in default configurations where SVG uploads are permitted. No official patch has been released as of this analysis.

Supply Chain & Package Security

DokuWiki is a PHP-based application distributed as a self-hosted package. The vulnerability does not directly affect package registries (NPM, PyPI, Go, Ruby), but administrators should verify the integrity of their DokuWiki installation and monitor for updates from the official repository.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, likely due to incomplete scoring data. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (Score: 8.8 - High)

• Attack Vector (AV): Network - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): Low - An attacker needs a valid user account to access the Media Manager.
• User Interaction (UI): None - No user interaction is required beyond the attacker's actions.
• Scope (S): Unchanged - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High - Arbitrary code execution can lead to data exfiltration.
• Integrity (I): High - The attacker can modify files and system state.
• Availability (A): High - The attacker can disrupt service or delete data.

Threat Level: High. The vulnerability allows remote code execution with low complexity, though it requires authentication.

Deep Dive & Mechanics

The vulnerability resides in the Media Manager component, which handles file uploads. DokuWiki allows SVG file uploads by default for media management. The issue is that SVG files are XML-based and can contain embedded JavaScript or XXE payloads. When the server processes or renders the SVG, the embedded code can be executed.

Attack Vector:

1. An attacker logs into DokuWiki with a valid user account.
2. The attacker crafts an SVG file containing malicious content, such as:
   • XXE payload to read local files (e.g., /etc/passwd).
   • JavaScript embedded in <script> tags for XSS or further exploitation.
   • PHP code injection if the SVG is processed by a PHP parser.
3. The attacker uploads the SVG file via the Media Manager.
4. When the SVG is accessed or processed (e.g., via a wiki page or direct URL), the malicious code executes.

Root Cause: Lack of proper validation and sanitization of SVG file contents. The application does not strip dangerous XML elements or JavaScript from uploaded SVG files.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is the default Media Manager upload handler in DokuWiki 2024-02-06a. The patched code would require additional validation.

Vulnerable Code (Conceptual):

// In lib/exe/media.php or similar
function handle_upload($file) {
    $allowed_extensions = ['svg', 'png', 'jpg'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, $allowed_extensions)) {
        move_uploaded_file($file['tmp_name'], $upload_path);
    }
}

Patched Code (Conceptual):

function handle_upload($file) {
    $allowed_extensions = ['svg', 'png', 'jpg'];
    $ext = pathinfo($file['name'], PATHINFO_EXTENSION);
    if (in_array($ext, $allowed_extensions)) {
        if ($ext === 'svg') {
            $content = file_get_contents($file['tmp_name']);
            // Remove script tags and dangerous XML
            $content = preg_replace('/<script\b[^>]*>(.*?)<\/script>/is', '', $content);
            $content = preg_replace('/<!ENTITY\s+[^>]*>/i', '', $content);
            file_put_contents($upload_path, $content);
        } else {
            move_uploaded_file($file['tmp_name'], $upload_path);
        }
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid DokuWiki user account with upload permissions.
• Access to the Media Manager (typically at /dokuwiki/lib/exe/mediamanager.php).

Exploit Steps:

1. Craft a malicious SVG file. Example for XXE to read /etc/passwd:

   <?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE foo [
     <!ENTITY xxe SYSTEM "file:///etc/passwd">
   ]>
   <svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
     <text x="10" y="20">&xxe;</text>
   </svg>
   

2. Upload the SVG file via the Media Manager.
3. Access the uploaded file at http://target/dokuwiki/lib/exe/fetch.php?media=namespace:malicious.svg to trigger the XXE.

Alternative Payload for RCE (if PHP processing is enabled):

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg">
  <script type="text/javascript">
    // JavaScript for XSS or further exploitation
    alert('XSS');
  </script>
</svg>

Blue Team

Detection:

• Monitor file uploads for SVG files with suspicious content (e.g., <!ENTITY, <script>).
• Check web server logs for requests to /lib/exe/fetch.php with SVG files.
• Use file integrity monitoring to detect unauthorized changes.

Hunting:

• Search for SVG files in the media directory that contain XML entities or script tags.
• Review DokuWiki access logs for unusual upload patterns.

Indicators of Compromise (IOCs)

• File Hashes: (Example hashes for a malicious SVG)
  • MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6
  • SHA1: 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b
• Network Indicators:
  • Outbound connections to attacker-controlled servers (for XXE exfiltration).
  • Unusual HTTP requests to /lib/exe/fetch.php with SVG parameters.
• File System Indicators:
  • SVG files in data/media/ containing <!ENTITY or <script> tags.
  • Unexpected files in the web root (e.g., PHP shells).

Detection Engineering

YARA Rule

rule CVE_2024_33103_SVG_Malicious {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2024-33103"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33103"
    strings:
        $xxe = /<!ENTITY\s+\w+\s+SYSTEM\s+/ nocase
        $script = /<script\b[^>]*>/ nocase
        $php_code = /<\?php/i
    condition:
        ($xxe or $script or $php_code) and filesize < 1MB
}

Sigma Rule

title: DokuWiki SVG File Upload with Malicious Content
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects upload of SVG files containing XXE or script tags to DokuWiki
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'mediamanager.php'
        cs-uri-query|contains: '.svg'
    condition: selection
falsepositives:
    - Legitimate SVG uploads with embedded scripts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-33103 DokuWiki SVG Upload Attempt"; flow:to_server,established; content:"POST"; http_method; content:"mediamanager.php"; http_uri; content:".svg"; http_uri; pcre:"/<script|<\!ENTITY/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in DokuWiki configuration:
   • Edit conf/local.php and add: $conf['mediarevisions'] = 0; (if applicable) or restrict file types.
   • Alternatively, modify the Media Manager to reject SVG files by editing lib/exe/media.php.
2. Implement a Web Application Firewall (WAF) rule to block SVG files containing XXE or script tags.
3. Restrict user permissions to only trusted users for file uploads.

Long-term Fix:

• Monitor the DokuWiki repository for an official patch.
• Apply input validation and sanitization for SVG files as shown in the patched code section.
• Consider using a dedicated SVG sanitizer library (e.g., svg-sanitizer for PHP).

Workaround:

• Convert uploaded SVG files to PNG on the server side using a tool like ImageMagick, stripping all embedded code.

Valters IT
DevSecOps & Cyber Threat Intelligence