Page MenuHomePhabricator

security gap: IP style user names - IP range style user names - hijacking these accounts
Closed, ResolvedPublic


Author: gangleri


It should not be possible to create IP type accounts because MediaWiki makes a
kind of validation and displays [[en:MediaWiki:Noname]].

However surfing today I have seen edits of an / some anon users at

I was able to *hijack* this account - see [[]] . Before
doing this I also created the account [[]].

Please close this security gap. You may cancel both accounts from the database.

Best regards Reinhardt [[user:gangleri]]

Version: 1.6.x
Severity: critical



Event Timeline

bzimport raised the priority of this task from to High.Nov 21 2014, 8:50 PM
bzimport set Reference to bz3631.
bzimport added a subscriber: Unknown Object (MLST).

gangleri wrote:

Please watch [[Special:Log/newusers]] for abuse as long as this security gap is
not closed.

brion added a comment.Oct 6 2005, 11:39 PM

What security gap? These are not IP addresses, though they may somewhat resemble
them in a vague way.

gangleri wrote:

The security gap consists in hijacking others contributions.

[[]] was created yesterday. But others people
contributions are now contributions of this account. Probably this conflicts
with wiki policy.

see [[en:Special:Contributions/]]

Best regards Reinhardt [[user:gangleri]]

gangleri wrote:


a) There might be other cases in [[en:]] its sisterprojects or projects in other
b) Some have more contributions then required ford board votes (in the past).
c) I have no clue what would happen if an anon user from IP range would tray to make some edits. Maybe xxx in is a
historical issue. If it is not then is ambiguous now: it could
be an anon user or it could be a logged in user with this user name. Such
ambiguosities would not make life easier.

Best regards Reinhardt [[user:gangleri]]

avarab wrote:

  • IP addresses has the form /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/
  • A logged in user does not match an IP address

Where is the ambiguity?

brion added a comment.Oct 7 2005, 9:01 PM

Looks like it matches old recorded anon bits from 2001 (UseMod obscured the final octet
of the ip for anons, at least sometimes). Note that the same applies to any unclaimed
UseMod-era account name.

gangleri wrote:

(In reply to comment #5)

  • IP addresses has the form /\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/
  • A logged in user does not match an IP address

Where is the ambiguity?
shows three such "contributors". You may find these contributions also at
As I told item c) might be a historical issue and not an ambuguity any more.

avarab wrote:

Okey so some usemod usernames use account names that kind of look like IP
addresses but should not be detected as such anywhere in the software, where's
the critical security issue here?

gangleri wrote:

(In reply to comment #8)

where's the critical security issue here?

It is not trivial to log in as [[User:Ævar Arnfjörð Bjarmason]]. But it is easy
to log in as usemod usernames:

All [[Special:Contributions/]] belong now to this "user".

avarab wrote:

FIXED the issue in HEAD (not in any other branches since other websites probably
don't have stale usemod usernames running around), temp sysopped myself on
enwiki and permbanned the users that used this bug.

gangleri wrote:

Thank you Ævar! Regards Reinhardt