Vulnerability record · CVE-2004-1037 · published 1 March 2005
CVE-2004-1037: TWiki search function allows remote command execution
Twiki · Twiki
The search function in TWiki 20030201 passes user-supplied search strings to a shell without sanitizing shell metacharacters, allowing command injection. Because the endpoint is reachable over the network with no authentication, this is a full remote code execution flaw in a wiki that is typically internet-facing.
Description
The search function in TWiki 20030201 allows remote attackers to execute arbitrary commands via shell metacharacters in a search string.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityUnauthenticated network-reachable remote code execution with a CVSS 2.0 score of 10 and a very high EPSS probability, though the product version is old.
What it is
The search function in TWiki 20030201 passes user-supplied search strings to a shell without sanitizing shell metacharacters, allowing command injection. Because the endpoint is reachable over the network with no authentication, this is a full remote code execution flaw in a wiki that is typically internet-facing.
Impact
An unauthenticated attacker can execute arbitrary commands with the privileges of the web server user, leading to full compromise of the TWiki host and any data or credentials it can reach.
Attack surface
Reached over the network via the TWiki search function (AV:N/AC:L/Au:N per the CVSS 2.0 vector); no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.61668 (99.13th percentile) and a SecurityFocus reference is tagged Exploit, indicating public exploit code exists.
What to do
- Upgrade TWiki to a version that fixes the search command injection; the vendor security alert and Gentoo GLSA-200411-33 list the fixed releases.
- If immediate upgrade is not possible, disable or restrict the search function and remove shell metacharacters from search input at the web server or proxy.
- Run TWiki under a low-privilege account with no shell access and restrict outbound network access from the web server.
- Apply the vendor and distribution patches referenced in the advisory (Gentoo, Conectiva) if using packaged TWiki.
Detection
- Inspect web server and TWiki logs for search requests containing shell metacharacters such as ;, |, `, $(), && or newlines.
- Monitor for unexpected child processes spawned by the web server user (sh, bash, curl, wget, nc).
- Alert on outbound connections or file writes originating from the TWiki process outside normal behavior.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2004-1037 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2004-1037), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
