CVE-2019-12468
📋 TL;DR
This vulnerability allows attackers to bypass re-authentication when changing email addresses in MediaWiki, potentially leading to account takeover. It affects MediaWiki installations running versions 1.27.0 through 1.32.1, including Wikimedia deployments and other users of the software.
💻 Affected Systems
- Wikimedia MediaWiki
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could take over administrator or high-privilege accounts, leading to data manipulation, content deletion, or further system compromise.
Likely Case
Attackers could hijack user accounts to post malicious content, steal sensitive information, or escalate privileges.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized email changes, which can be detected and reverted.
🎯 Exploit Status
Exploitation requires an attacker to have an account and send a POST request to Special:ChangeEmail, bypassing re-authentication checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.32.2 or later
Vendor Advisory: https://phabricator.wikimedia.org/T197279
Restart Required: No
Instructions:
1. Upgrade MediaWiki to version 1.32.2 or later. 2. Apply patches from the vendor advisory if upgrading is not immediate.
🔧 Temporary Workarounds
Disable email change functionality
allTemporarily restrict access to the Special:ChangeEmail page to prevent exploitation.
Edit LocalSettings.php to add: $wgGroupPermissions['*']['changeemail'] = false;
🧯 If You Can't Patch
- Implement strict access controls and monitoring for POST requests to Special:ChangeEmail.
- Enforce multi-factor authentication for sensitive account actions to reduce risk of account takeover.
🔍 How to Verify
Check if Vulnerable:
Check the MediaWiki version in the software or via the Special:Version page; if it is between 1.27.0 and 1.32.1, it is vulnerable.Check Version:
Check the Special:Version page in MediaWiki or inspect the software files for version information.Verify Fix Applied:
Confirm the MediaWiki version is 1.32.2 or later, and test that re-authentication is required for email changes.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to Special:ChangeEmail without re-authentication events
- Multiple email change attempts from single user accounts
Network Indicators:
- HTTP POST traffic to /wiki/Special:ChangeEmail without preceding authentication checks
SIEM Query:
source="mediawiki_logs" AND url="/wiki/Special:ChangeEmail" AND method="POST" AND NOT event="reauthentication"🔗 References
- https://lists.wikimedia.org/pipermail/mediawiki-announce/
- https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
- https://phabricator.wikimedia.org/T197279
- https://seclists.org/bugtraq/2019/Jun/12
- https://www.debian.org/security/2019/dsa-4460
- https://lists.wikimedia.org/pipermail/mediawiki-announce/
- https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
- https://phabricator.wikimedia.org/T197279
- https://seclists.org/bugtraq/2019/Jun/12
- https://www.debian.org/security/2019/dsa-4460
