CVE-2021-41801
📋 TL;DR
This vulnerability in MediaWiki's ReplaceText extension allows blocked users to still execute previously submitted text replacement jobs through the job queue. It affects MediaWiki installations using ReplaceText extension versions up to 1.41. The issue enables unauthorized content modification even after user privileges have been revoked.
💻 Affected Systems
- MediaWiki ReplaceText Extension
📦 What is this software?
Mediawiki by Mediawiki
Mediawiki by Mediawiki
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Blocked malicious users could modify sensitive content across the wiki, potentially defacing pages, inserting malicious code, or altering critical information.
Likely Case
Blocked users with pending replacement jobs could unintentionally or maliciously modify wiki content they should no longer have access to edit.
If Mitigated
With proper monitoring and job queue management, impact is limited to delayed unauthorized edits that can be detected and reverted.
🎯 Exploit Status
Exploitation requires a user account with ReplaceText privileges that gets blocked after job submission.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ReplaceText extension version 1.42+
Vendor Advisory: https://phabricator.wikimedia.org/T279090
Restart Required: No
Instructions:
1. Update ReplaceText extension to version 1.42 or later. 2. Update via MediaWiki extension manager or manually replace extension files. 3. No MediaWiki core update required.
🔧 Temporary Workarounds
Disable ReplaceText Extension
allTemporarily disable the vulnerable extension until patched
Remove or comment out wfLoadExtension('ReplaceText'); from LocalSettings.php
Clear Job Queue After Blocking Users
allManually remove pending jobs from blocked users
DELETE FROM job WHERE job_cmd = 'replaceText' AND job_user = [BLOCKED_USER_ID]
🧯 If You Can't Patch
- Implement strict monitoring of job queue and user blocking events
- Disable ReplaceText functionality for all non-admin users
🔍 How to Verify
Check if Vulnerable:
Check ReplaceText extension version in MediaWiki's Special:Version page or extension directoryCheck Version:
grep -r 'ReplaceText.*version' /path/to/mediawiki/extensions/ReplaceText/Verify Fix Applied:
Confirm ReplaceText extension version is 1.42 or higher in Special:Version📡 Detection & Monitoring
Log Indicators:
- Job queue executions by blocked users
- ReplaceText jobs running after user blocking events
Network Indicators:
- Unusual pattern of text replacement API calls
SIEM Query:
source="mediawiki_logs" AND (event="job_run" OR event="user_blocked") | stats count by user🔗 References
- https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
- https://phabricator.wikimedia.org/T279090
- https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
- https://phabricator.wikimedia.org/T279090
