Introduction
The MathType library by Wiris integrates with several Learning Management Systems (LMS) and HTML editors, including:
- MathType for CKEditor 5 (Node.js, PHP, Java)
- MathType for CKEditor 4 (PHP, ASP.NET, Java, Ruby on Rails)
- MathType for TinyMCE 5 (Node.js, PHP, Java)
- MathType for TinyMCE 4 (PHP, ASP.NET, Java, Ruby on Rails)
- MathType for WordPress
- MathType for Moodle
Vulnerability Discovery
A vulnerability was identified in which URL parameters passed to the application were not properly sanitised. Specifically, a parameter called resourcefile was used directly to access and return files from the server. This means attackers could request arbitrary files by manipulating the URL, potentially accessing sensitive files like configuration files or source code.
The code in question extracted the resourcefile parameter, then used it to set a content type and return the file’s content without validating or sanitising the input. This created a risk of path traversal—an attacker could request files outside of the intended directory by supplying paths like ../../config.php.
Exploitation Example
A simple test of this vulnerability on a Moodle site using a vulnerable version of Wiris MathType (v7.28.0 or earlier) could look like this:
- http://<target-site>/filter/wiris/integration/resource.php?resourcefile=../../../../config.php
If successful, this would return the contents of Moodle’s config.php file, potentially revealing database credentials and other secrets.
For Blackboard instances, similar payloads were tested. In many cases, the Tomcat web server prevented traversal attacks using built-in path normalisation, but older or misconfigured servers could still be vulnerable. Some example payloads include:
- https://<blackboard-url>/webapps/vtbe-tinymce/app/resource?resourcefile=../../WEB-INF/web.xml
- https://<blackboard-url>/webapps/vtbe-tinymce/app/resource?resourcefile=../../WEB-INF/bb-manifest.xml
Impact
If exploited, the vulnerability could allow an attacker to:
- Access cleartext credentials from config files
- Retrieve source code or internal documentation
- Potentially pivot to deeper access within the server environment depending on other misconfigurations
Remediation
Wiris has addressed this issue by removing the vulnerable resource handler code entirely. This was actioned on 18 May 2022. To mitigate this vulnerability, users should ensure they are using Wiris MathType v7.28.1 or later.
More details on the patch and its implementation are available on Wiris' official GitHub repository and security advisory pages.
Disclosure Timeline
- 22 April 2022 – Issue reported to Wiris
- 18 May 2022 – Vulnerable code removed by Wiris
- 16 June 2022 – CVE-2022-31372 assigned
