Remote Code Execution Vulnerability in MediaWiki Score Extension
CVE-2020-29007
9.8CRITICAL
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2020-29007?
The Score extension for MediaWiki, up to version 0.3.0, contains a vulnerability that allows remote code execution stemming from inadequate sandboxing of the GNU LilyPond executable. This flaw enables any user with editing privileges—potentially including unauthenticated users—to execute arbitrary Scheme or shell code by crafting specific image data to generate musical scores. This exploitation poses a significant security risk, as it may allow attackers to run malicious code on the server.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.