Multiple vulnerabilities in MediaWiki Extensions and Skins

1) Improper access control

EUVDB-ID: #VU89200

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34505

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to temporary account IP reveal does not check the deleted status in the CheckUser extension. A remote attacker can bypass implemented security restrictions and gain unauthorized access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/992795

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site request forgery

EUVDB-ID: #VU89205

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-34501

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the CheckUser Client Hints REST API. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/
http://gerrit.wikimedia.org/r/q/Idc776c7c7612c8b9e2c134706c9e2ebc2f5b655f

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cross-site request forgery

EUVDB-ID: #VU89206

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-34503

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the ReportIncident REST API. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/
http://gerrit.wikimedia.org/r/q/I27b5899cf69837c9ab8fee2b5bc9b2e788e69f9e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cross-site request forgery

EUVDB-ID: #VU89207

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-34504

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to insufficient validation of the HTTP request origin in the IPInfo REST APIs. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/
http://gerrit.wikimedia.org/r/q/I5974c1e71286f5f920ace51ba064e96c88296a4e

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Cross-site scripting

EUVDB-ID: #VU89211

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-25107

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the WikiDiscover extension on Special:WikiDiscover. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv-455f
http://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3fd6bb
http://issue-tracker.miraheze.org/T11814
http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cross-site scripting

EUVDB-ID: #VU89212

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-34500

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data within interface message in UnlinkedWikibase extension. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://phabricator.wikimedia.org/T357203
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/1002175

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper access control

EUVDB-ID: #VU89213

Risk: Medium

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2024-34502

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists in the WikibaseLexeme extension due to Special:MergeLexemes makes edits on GET requests without edit tokens. A remote attacker can make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://phabricator.wikimedia.org/T357101
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/1013359
http://gerrit.wikimedia.org/r/q/Iae0c7c3b979118559c9ce2276618c6cdec11e63d

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) SQL injection

EUVDB-ID: #VU89214

Risk: High

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2023-29134

CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data in Cargo extension handling of quotes inside backticks. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.

Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://phabricator.wikimedia.org/T331362
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/898722
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/895774
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/900133
http://phabricator.wikimedia.org/rECRG920f3c19a84175bcfe93f41ecf9f8cef32730f8e
http://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1005478

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Cross-site scripting

EUVDB-ID: #VU89215

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-25109

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the extensions, settings, permissions and namespaces subpages of Special:ManageWiki. A remote user can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://github.com/miraheze/ManageWiki/security/advisories/GHSA-4jr2-jhfm-2r84
http://github.com/miraheze/ManageWiki/commit/2ef0f50880d7695ca2874dc8dd515b2b9bbb02e5
http://github.com/miraheze/ManageWiki/commit/6942e8b2c01dc33c2c41a471f91ef3f6ca726073
http://github.com/miraheze/ManageWiki/commit/886cc6b94587f1c7387caa26ca9fe612e01836a0
http://issue-tracker.miraheze.org/T11812
http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Information disclosure

EUVDB-ID: #VU89216

Risk: Low

CVSSv4.0: [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2024-29883

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists in the CreateWiki extension due to the Special:ManageWiki does not escape escape interface messages. A remote administrator can gain unauthorized access to sensitive information on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

MediaWiki: 1.39.0 rc.0 - 1.41.0

CPE2.3

External links

http://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9
http://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch
http://issue-tracker.miraheze.org/T11993
http://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/ISK76VXYSIOKYLLU2DTQUXIJV6MMWGOJ/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	10
CVE-ID	CVE-2024-34505 CVE-2024-34501 CVE-2024-34503 CVE-2024-34504 CVE-2024-25107 CVE-2024-34500 CVE-2024-34502 CVE-2023-29134 CVE-2024-25109 CVE-2024-29883
CWE-ID	CWE-284 CWE-352 CWE-79 CWE-89 CWE-200
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	MediaWiki Web applications / CMS
Vendor	MediaWiki.org