CVE-2021-31555
📋 TL;DR
This vulnerability in MediaWiki's OAuth extension allows attackers to submit overly long oarc_version parameters, potentially causing buffer overflows or denial of service. It affects MediaWiki installations using the OAuth extension through version 1.35.2. Attackers could exploit this to crash the service or execute arbitrary code.
💻 Affected Systems
- MediaWiki with OAuth extension
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise
Likely Case
Denial of service through application crashes or instability
If Mitigated
Minimal impact with proper input validation and length restrictions
🎯 Exploit Status
Exploitation requires OAuth endpoint access; complexity depends on specific buffer overflow implementation
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.35.3 or later
Vendor Advisory: https://phabricator.wikimedia.org/T277388
Restart Required: Yes
Instructions:
1. Update MediaWiki to version 1.35.3 or later
2. Apply the patch from gerrit.wikimedia.org/r/q/I222c053b4b14ac1ad0f5b3a51565b1b9cd4c139d
3. Restart the web server
🔧 Temporary Workarounds
Input validation filter
allAdd custom validation to restrict oarc_version parameter length
Implement input validation in OAuth extension code to limit parameter size
WAF rule
allBlock requests with excessive oarc_version parameter length
Configure WAF to reject requests with oarc_version parameter exceeding 255 characters
🧯 If You Can't Patch
- Disable OAuth extension if not required
- Implement network segmentation to restrict access to OAuth endpoints
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version and OAuth extension statusCheck Version:
grep -i 'version' LocalSettings.php or check MediaWiki Special:Version pageVerify Fix Applied:
Verify MediaWiki version is 1.35.3+ and check for proper input validation in OAuth code📡 Detection & Monitoring
Log Indicators:
- Unusually long parameter values in OAuth requests
- Application crashes or errors related to OAuth processing
Network Indicators:
- Excessive POST data to OAuth endpoints
- Repeated failed OAuth requests
SIEM Query:
source="mediawiki" AND (parameter="oarc_version" AND length>255) OR error="buffer overflow"