CVE-2016-7146

What it actually does

Remote attackers can inject arbitrary JavaScript into the MoinMoin wiki by supplying a malicious page name to the action=fckdialog&dialog=attachment endpoint, which is reflected without proper sanitization and executes in the context of other users.

Why it matters to the business

Attackers may hijack user sessions, steal credentials, or perform actions on behalf of authenticated wiki users, leading to data leakage or unauthorized content changes in collaborative documentation platforms.

How an attack unfolds

An attacker identifies a MoinMoin instance and crafts a URL containing JavaScript in the page parameter for the attachment dialog handler; when a victim visits the link, the script executes in their browser, enabling theft of cookies or other client-side actions. Public exploit code has been available for years.

How to fix it

Upgrade MoinMoin to a version that properly sanitizes page names in the fckdialog attachment handler; if no newer package release is available, apply input validation and output encoding patches around the affected dialog component and restrict or disable the fckdialog feature where possible.

How to confirm the fix worked

Review the source of the attachment dialog handler to confirm page-name values are HTML-escaped before rendering; test by submitting a page name containing a script tag and verifying it is not executed.

Typical attack path

1. Locate a reachable MoinMoin wiki instance
2. Craft a URL targeting action=fckdialog&dialog=attachment with a malicious page name containing JavaScript
3. Deliver the link via email, chat, or another channel to a logged-in user
4. Victim loads the URL, triggering script execution in the browser
5. Attacker receives exfiltrated data or performs further actions via the injected script

How to detect it

Inspect web server access logs for requests containing the fckdialog attachment action with unusually long or script-containing page parameters; look for repeated hits from the same source IP or referrers that do not match normal wiki navigation.

• action=fckdialog&dialog=attachment
• page=.*<script
• /?action=fckdialog

What your security team should do

• Prioritize upgrade or patch of all MoinMoin instances given the public exploit availability
• Implement web application firewall rules to block requests containing script tags in the page parameter for the affected action
• Monitor for unusual attachment dialog access patterns in web logs
• Educate wiki administrators on disabling unused editor dialogs if patching is delayed