I was able to successfully masquerade with another one of my user accounts using the [[ https://github.com/CWRUChielLab/CASAuth | CASAuth ]] extension. While that extension has been abandoned, other SSO client extensions may be at risk.
To log in as "foobar", one only need to create an account like: "_foobar" or "foobar_" with the SSO provider, and log in with that user name. As a result, one gains access to the "foobar" account. If one's acount is "foo_bar", then "foo__bar" and "foo bar" also work.
By gaining access to an admin account, one could delete arbitrary pages or otherwise vandalize the site.
This appears to be due to the automatic normalization performed by MW code when creating user names (`User:newFromName`). The workaround I'm using for now is:
````
--- CASAuth.php.orig 2020-09-21 16:50:52.757932797 -0400
+++ CASAuth.php 2020-09-21 16:29:07.448092263 -0400
@@ -117,6 +117,17 @@
return true;
}
+ $collision_0 = "/^_/";
+ $collision_1 = "/_$/";
+ $collision_2 = "/__/";
+ $collision_3 = "/ /";
+ if(preg_match($collision_0, "$username") || preg_match($collision_1, "$username") || preg_match($collision_2, "$username") || preg_match($collision_3, "$username"))
+ {
+ // redirect user to the RestrictRedirect page
+ $wgOut->redirect($CASAuth["RestrictRedirect"]);
+ return true;
+ }
+
// Get MediaWiki user
$u = User::newFromName($username);
````
While I have only tested the CASAuth extension, I fear that this security bug may be more widespread, so I've only reported this issue to other members of the technical team I am a part of at work, and to you.
Does your team generally assist in coordination with multiple extension maintainers, or should I try to contact every maintainer of MW SSO login extensions? I figure that if that there isn't any coordination, that some maintainers may release before others, leading to insight by malicious users.
Thanks for your help. : ) Andrew