Skip to content

Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`

Moderate
redbluegreenhat published GHSA-4rcf-3cj2-46mq Mar 27, 2024

Package

CreateWiki (MediaWiki)

Affected versions

<23415c17ffb4832667c06abcf1eadadefd4c8937

Patched versions

=>23415c17ffb4832667c06abcf1eadadefd4c8937

Description

Impact

It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit 6bc0685. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere.

Patches

https://issue-tracker.miraheze.org/F3093343

Issue has also been fixed as of commit 3415c1

Workarounds

Disable Special:RequestWikiQueue outside of the wiki where you receive wiki requests. An example of this is available at miraheze/mw-config@fb3e68b

References

https://issue-tracker.miraheze.org/T11999

Severity

Moderate

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

CVE ID

CVE-2024-29897

Weaknesses

Credits