2021-12 biztonsági kiadás/GYIK

Számos sebezhetőséget találtak a MediaWikiben, ami lehetővé teszi, hogy egy támadó tartalmakat szivárogtasson ki privát wikikből, és áthidaljon szerkesztési jogosultságokat. The main vector for this wiki-leak is using vulnerable actions on pages that are listed in $wgWhitelistRead and therefore publicly accessible. MediaWiki now only makes the "view" action publicly accessible on pages in $wgWhitelistRead by default. These issues are fixed in 1.35.5, 1.36.3, and 1.37.1, see the announcement for links to tarballs and patches.

Mik a hibák?

• CVE-2021-44858: A „visszavonás” funkció (action=edit&undo=##&undoafter=###) lehetővé tette, hogy egy támadó bármilyen szerkesztés tartalmát megtekintse, függetlenül a jogoktól. Ugyanez igaz volt a „mcrundo” és „mcrrestore” (action=mcrundo és action=mcrrestore) esetén is.

• CVE-2021-45038: The "rollback" feature (action=rollback) could be passed a specially crafted parameter that allowed an attacker to view the contents of arbitrary pages, regardless of whether they had permissions to do so.

• CVE-2021-44857: The "mcrundo" and "mcrrestore" actions (action=mcrundo and action=mcrrestore) did not properly check for editing permissions, and allowed an attacker to take the content of any arbitrary revision and save it on any page of their choosing. This affects both public wikis and public pages on private wikis.

Nincs időm a javításra, hogy tilthatom le ezt?

Add hozzá az alábbit a LocalSettings.php-edhez:

$wgActions['mcrundo'] = false;
$wgActions['mcrrestore'] = false;

Ha a wikid privát (az oldalak megtekintése bejelentkezéshez kötött), ezt is be kell állítani:

$wgWhitelistRead = [];
$wgWhitelistReadRegexp = [];

It should fully disable the vulnerable code. These changes will also work for vulnerable end-of-life MediaWiki versions that do not have a patch available.

If you used $wgWhitelistRead to allow logged-out users to see the main page with help text, you should instead move that help text to the MediaWiki:Loginreqpagetext message, which is shown on the "login required" error.

Érintett vagyok?

• Ha a wikid nyilvános (bárki olvashatja a lapjait): igen
• Ha a wikid privát, és a $wgWhitelistRead vagy $wgWhitelistReadRegexp legalább egy lapot tartalmaz: igen

If you use an extension like Lockdown or Whitelist Pages to make some pages unreadable to some users, you are also likely affected.

Mely verziók sebezhetők?

All MediaWiki versions since 1.23.0 until 1.34.x, and 1.35.x, 1.36.x, 1.37.x before the fixes (see the top section), are vulnerable to the private wiki read permissions bypasses (CVE-2021-44858, CVE-2021-45038).

All MediaWiki versions since 1.32.0 until 1.34.x, and 1.35.x, 1.36.x, 1.37.x before the fixes (see the top section), are vulnerable to the editing permissions bypass (CVE-2021-44857).

How is this being fixed long-term?

All actions except "view" now require an explicit "read" user right. This is similar to permission checks used in the Action and REST APIs. If further vulnerabilities are found in actions, they will at least not be exploitable by logged-out users on private wikis.

Actions that need to be usable on $wgWhitelistRead pages can override the new Action::needsReadRight() function.

How can I see if someone exploited it on my wiki?

Look for action=mcrundo or action=mcrrestore in your access logs. Unless you specifically enabled an extension that uses multi-content revisions, there is no legitimate use for these actions.

In addition, look for action=edit&undo=###&undoafter=### requests and check whether the revision IDs belong to a different title than the page being edited.

For the rollback bug, look for action=rollback&from=... where the "from" parameter is a template transclusion (for example, from={{:private page}}).

This bug does not cause any data loss, so any write actions an attacker could have taken will be recorded in page history like all other edits.

Credit

A hibát Dylsss fedezte fel, sok köszönet neki a hiba azonosításáért és jelentéséért. Ha hibát találsz a MediaWikiben, lásd a biztonsági hibák jelentésének folyamatát.