Remote Code Execution in DokuWiki Librarian 56.2

Executive Summary

This vulnerability exists in DokuWiki version 2025-05-14b "Librarian" 56.2, where a remote attacker can execute arbitrary code by exploiting the register function in the file inc/auth.php.

Useful 0 Not Useful 0

Detection Guidance

This issue can be detected by monitoring for unauthorized or unexpected user account creation attempts via the registration endpoint of DokuWiki. Since the vulnerability involves sending crafted HTTP POST requests to the registration function, network traffic inspection tools can be used to identify such requests.

Suggested commands include using curl or similar tools to test the registration endpoint manually, for example:

• curl -X POST -d 'user=username&password=pass123&[email protected]' https://your-dokuwiki-site/doku.php?id=start&do=register
• Use network monitoring tools like tcpdump or Wireshark to capture HTTP POST requests to the registration URL and analyze for suspicious or automated account creation attempts.

Additionally, reviewing DokuWiki logs for registration events and enabling logging of registration attempts can help detect exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability could run arbitrary code on the affected system remotely, potentially leading to full system compromise, unauthorized access, data theft, or disruption of services.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability involves unauthorized user registration in DokuWiki when self-registration is enabled, potentially allowing attackers to create accounts without authentication.

If exploited, this could lead to unauthorized access and account creation, which may impact compliance with standards like GDPR or HIPAA that require strict access controls and user authentication.

However, the behavior is disputed by the supplier as it is an intentional feature when self-registration is enabled, and not a vulnerability per se.

Mitigations such as disabling self-registration, enabling CAPTCHA, and logging registration attempts are recommended to reduce risks and help maintain compliance with regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include disabling self-registration if it is not required by setting the configuration option disableactions=[register] in the DokuWiki installer or config manager.

If self-registration is needed, enable spam protection mechanisms such as CAPTCHA on the registration form to prevent automated account creation.

Configure Access Control Lists (ACLs) properly to restrict permissions for newly created accounts.

Ensure email services are properly configured to handle password delivery securely, especially if autopasswd is enabled.

Enable logging of registration attempts for auditing and monitoring purposes.

Useful 0 Not Useful 0