Possible DoS vulnerability in MediaWiki
Closed, ResolvedPublic
Actions

Assigned To

None

Authored By

	• csteipp
	Oct 25 2012, 7:08 PM

Description

patch from Kevin

I'm the "Wikipedia user PleaseStand" who reported the clickjacking
vulnerability in 2010, and I think I have another security issue to report.

On the English Wikipedia's technical village pump, user Kelisi reported
that a certain article's history page would show a "Fatal exception of
type MWException" only when he was logged in.[1]

I debugged the issue and found that the cause was an inefficient regex
in includes/Linker.php in core MediaWiki. Specifically, the regex hit
the PCRE backtrack limit while processing an edit summary,[2] so
preg_replace_callback() returned null. The fatal exception occurred when
the null value was to be inserted as a message parameter.

I'm reporting this issue through private e-mail, as I know such
exponential behavior can allow for denial of service attacks, and I'm
sure the vandals would enjoy making it hard for people to revert their
edits :)

They just have to put something like this in their edit summaries:

[[aaaa]|aaaa]|aaaa]| ... (repeated at least 13 times more)

and that would break recent changes, watchlists, and history pages all
at once. The API, by the way, just returns null for the "parsedcomment".

I have attached a patch that should fix the regex. Feel free to make any
improvements. I've tested it against the recent histories (newest 1000
revisions) of three English Wikipedia articles.

Keep in mind it's possible that someone might inadvertently add
information to the village pump thread that makes it easier to find the
vulnerability (e.g. a broken diff link).

Also, if I would like to report a vulnerability in a user-created
Wikipedia gadget, where should I send the report to? Here? I think I may
have found an unrelated vulnerability in Twinkle, although it might be
tricky to exploit.

Thanks,

Kevin Israel
(Wikipedia user PleaseStand)

[1]
https://en.wikipedia.org/wiki/Wikipedia:Village_pump_%28technical%29#Problem_with_.22Africville.22_article

[2]
https://en.wikipedia.org/w/index.php?title=Africville&oldid=360541408 -
try clicking on one of the diff links

Version: 1.20.x
Severity: normal

Attached:

0001-Optimized-regex-in-Linker.php.patch1 KBDownload

Details

Reference: bz41400

Event Timeline

• bzimport raised the priority of this task from to Needs Triage.Nov 22 2014, 12:45 AM

• bzimport added projects: MW-1.20-release, MediaWiki-General.

• bzimport set Reference to bz41400.

• bzimport added a subscriber: Unknown Object (MLST).

• csteipp created this task.Oct 25 2012, 7:08 PM

Kevin,

I was able to reproduce the issue, and the patch seems to fix the problem. Thank you!

We have just finalized our next security release, but we'll see if we can include this patch too.

The patch looks fine, although it would have been nice to see some comments embedded in the regex, maybe with /x.

I would also like to see a patch to remove the throw from Message::extractParam(). This is not the first user-visible exception we've seen from it, and throwing an exception instead of replacing the parameter with a placeholder increases the severity from a minor annoyance to a DoS vulnerability. If the error message really needs to be highly visible to developers, trigger_error(..., E_USER_WARNING) could be used.

Created attachment 11274
patch to comment new regex

Attached:

0002-Add-comments-to-Linker-formatLinksInComment.patch1 KBDownload

Created attachment 11275
patch to remove the throw

Tim, do you have a specific reason for using trigger_error() directly rather than using wfWarn()? Also, do you have a particular placeholder message in mind that would work in all contexts, or is it fine to just leave $1 alone?

attachment 0001-Remove-the-throw-from-Message-extractParam.patch ignored as obsolete

	F9575: 0001-Remove-the-throw-from-Message-extractParam.patch
	Nov 22 2014, 12:45 AM

	F9574: 0002-Add-comments-to-Linker-formatLinksInComment.patch
	Nov 22 2014, 12:45 AM

Possible DoS vulnerability in MediaWikiClosed, ResolvedPublicActions

Description

Details

Event Timeline

Possible DoS vulnerability in MediaWiki
Closed, ResolvedPublic
Actions