CVE-2021-46149
📋 TL;DR
This vulnerability allows attackers to cause denial of service by searching for extremely long language names in MediaWiki's Language Name Search feature. It affects MediaWiki installations running vulnerable versions, potentially impacting all users by consuming server resources and making the wiki unavailable.
💻 Affected Systems
- MediaWiki
📦 What is this software?
Mediawiki by Mediawiki
Mediawiki by Mediawiki
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to resource exhaustion, affecting all wiki functionality for legitimate users.
Likely Case
Temporary performance degradation or service interruption during attack periods.
If Mitigated
Minimal impact with proper rate limiting and resource monitoring in place.
🎯 Exploit Status
Simple HTTP request with long search parameter can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.35.5, 1.36.3, or 1.37.1
Vendor Advisory: https://phabricator.wikimedia.org/T293749
Restart Required: No
Instructions:
1. Backup your MediaWiki installation. 2. Update to MediaWiki 1.35.5, 1.36.3, or 1.37.1. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable Language Name Search
allTemporarily disable the vulnerable Language Name Search feature
Edit LocalSettings.php and add: $wgUseDatabaseMessages = false;
Implement Input Validation
allAdd input length validation for search parameters
Implement custom validation in search handlers to limit input length
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests with excessively long search parameters
- Implement rate limiting on search endpoints to prevent resource exhaustion attacks
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version in includes/DefaultSettings.php or via Special:Version pageCheck Version:
grep 'wgVersion' includes/DefaultSettings.phpVerify Fix Applied:
Verify version is 1.35.5, 1.36.3, or 1.37.1 or higher📡 Detection & Monitoring
Log Indicators:
- Unusually long search queries in access logs
- Multiple rapid search requests from single IP
- High CPU/memory usage correlated with search requests
Network Indicators:
- HTTP GET requests with extremely long 'search' parameters
- Pattern of repeated search requests
SIEM Query:
source="mediawiki_access.log" | search "search=*" AND length(search) > 1000