Page MenuHomePhabricator

ConfirmEdit hCaptcha: Verify sitekey in `siteverify` response was the sitekey given to the client as part of validating the captcha
Closed, ResolvedPublic

Description

Summary

The ConfirmEdit (CAPTCHA extension) hCaptcha captcha type verifies captchas using a call to an API named siteverify. This code should verify that the sitekey provided to the client matches the sitekey returned by the siteverify API

Background

  • hCaptcha in ConfirmEdit (CAPTCHA extension) allows varying the type of sitekey used for a given request
    • This includes varying the sitekey for an AbuseFilter consequence
  • Currently we do not enforce that the given response token sent by the client during the POST request is associated with any given sitekey
    • This means that a client could modify the JavaScript config variables to use a sitekey that has potentially less restrictions and may be easier to solve
  • To address these issues, we should ensure that the sitekey API response sitekey property is compared against the sitekey that should have been used for the request
    • If the sitekeys do not match, then we should consider that hCaptcha captcha check to have failed

Acceptance criteria

  • In HCaptcha::passCaptcha, the method should return false if the sitekey returned by the siteverify API does not match the the sitekey passed to the client

Event Timeline

sguebo_WMF changed the task status from Open to In Progress.Nov 15 2025, 12:49 AM

Change #1205290 had a related patch set uploaded (by Samuel (WMF); author: Samuel (WMF)):

[mediawiki/extensions/ConfirmEdit@master] hcaptcha: Validate sitekey used for /siteverify API calls

https://gerrit.wikimedia.org/r/1205290

Change #1205290 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Validate sitekey of /siteverify API call

https://gerrit.wikimedia.org/r/1205290

Change #1206906 had a related patch set uploaded (by Kosta Harlan; author: Samuel (WMF)):

[mediawiki/extensions/ConfirmEdit@wmf/1.46.0-wmf.3] hCaptcha: Validate sitekey of /siteverify API call

https://gerrit.wikimedia.org/r/1206906

Change #1206906 merged by jenkins-bot:

[mediawiki/extensions/ConfirmEdit@wmf/1.46.0-wmf.3] hCaptcha: Validate sitekey of /siteverify API call

https://gerrit.wikimedia.org/r/1206906

Mentioned in SAL (#wikimedia-operations) [2025-11-19T08:54:12Z] <kharlan@deploy2002> Started scap sync-world: Backport for [[gerrit:1206906|hCaptcha: Validate sitekey of /siteverify API call (T410024)]]

Mentioned in SAL (#wikimedia-operations) [2025-11-19T08:58:47Z] <kharlan@deploy2002> kharlan: Backport for [[gerrit:1206906|hCaptcha: Validate sitekey of /siteverify API call (T410024)]] synced to the testservers (see https://wikitech.wikimedia.org/wiki/Mwdebug). Changes can now be verified there.

Mentioned in SAL (#wikimedia-operations) [2025-11-19T09:04:45Z] <kharlan@deploy2002> Finished scap sync-world: Backport for [[gerrit:1206906|hCaptcha: Validate sitekey of /siteverify API call (T410024)]] (duration: 10m 32s)

hector.arroyo subscribed.

I've tested this fix by manually changing the public key in the page DOM to one I control (similar to what would be done in a real site key tampering attack), and then submitting the form: The API returns an error and the edit is not saved.

image.png (822×1 px, 295 KB)

Closing this task.