CVE-2021-36128
📋 TL;DR
This vulnerability in MediaWiki's CentralAuth extension allows improper implementation of autoblocks for suppression blocks. Attackers could bypass account blocks or suppression mechanisms, affecting all MediaWiki installations using CentralAuth with the vulnerable versions.
💻 Affected Systems
- MediaWiki
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass global account blocks, allowing banned users to continue editing across wikis, potentially leading to vandalism, misinformation, or unauthorized content changes.
Likely Case
Targeted users who should be blocked can continue accessing and editing content, undermining moderation and security controls.
If Mitigated
With proper monitoring and layered security controls, impact is limited to potential unauthorized edits that can be detected and rolled back.
🎯 Exploit Status
Exploitation requires understanding of CentralAuth block mechanisms but is technically straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.36.1 and later
Vendor Advisory: https://phabricator.wikimedia.org/T281972
Restart Required: No
Instructions:
1. Update MediaWiki to version 1.36.1 or later. 2. Apply the CentralAuth extension patches from the gerrit references. 3. Verify the fix by testing block functionality.
🔧 Temporary Workarounds
Disable CentralAuth Extension
allTemporarily disable the CentralAuth extension to mitigate the vulnerability
Edit LocalSettings.php and comment out or remove 'wfLoadExtension( "CentralAuth" );'
Manual Block Monitoring
allImplement enhanced monitoring of blocked users and manual verification of block effectiveness
🧯 If You Can't Patch
- Implement strict access controls and monitoring for all blocked user accounts
- Deploy additional authentication layers and rate limiting for sensitive operations
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version and CentralAuth extension status. If version is 1.36 or earlier with CentralAuth enabled, system is vulnerable.Check Version:
Check MediaWiki version in includes/DefaultSettings.php or via Special:Version pageVerify Fix Applied:
Test block functionality by creating a suppression block and verifying autoblocks work correctly.📡 Detection & Monitoring
Log Indicators:
- Unexpected successful edits from blocked users
- Failed block enforcement attempts
- CentralAuth block-related errors
Network Indicators:
- Unusual edit patterns from previously blocked IPs or accounts
SIEM Query:
source="mediawiki" AND (event="block bypass" OR user_status="blocked" AND action="edit")🔗 References
- https://gerrit.wikimedia.org/r/q/I15d14c88a1e30df92c470bc191c4ee573172d4d1
- https://gerrit.wikimedia.org/r/q/I3e65690695313380c798b62edfda726b6e374f89
- https://phabricator.wikimedia.org/T281972
- https://gerrit.wikimedia.org/r/q/I15d14c88a1e30df92c470bc191c4ee573172d4d1
- https://gerrit.wikimedia.org/r/q/I3e65690695313380c798b62edfda726b6e374f89
- https://phabricator.wikimedia.org/T281972
