Remote code execution can be achieved by authenticated users capable of accessing certain features.

Impact

An attacker could use this vulnerability to execute code on the server as the codendiadm user.
CVSSv3 score: 7.2 (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

Exploitation

The administrative function of search and replace of the PHPWiki administration but other sections of Tuleap might also be impacted.

The issue is due to an improper/missing neutralization of special elements before passing data to preg_replace(). Due to that, an attacker might be able to trigger the modifier PREG_REPLACE_EVAL to achieve code execution.

To demonstrate the issue with search and replace administrative function of PHPWiki:

1. Use the WikiAdminSearchReplace plugin by either accessing it from the PHPWiki admin or by adding <?plugin WikiAdminSearchReplace ?> in a wiki page.
2. Search and replace content in a wiki with the regex feature enabled
3. Either with an intercepting proxy or by replaying the request after the submission of the form, you want to modify the from parameter to something like somethingmatchinginthepage/e\0 and the to parameter to something like system('id');
4. Elements will be replaced in the page by the result of your command.

References

CWE-624