CVE-2022-28209
📋 TL;DR
This vulnerability in MediaWiki's AntiSpoof extension allows users with the 'override-antispoof' permission to bypass username spoofing checks. It affects MediaWiki installations with the AntiSpoof extension enabled, potentially allowing malicious actors to create misleading or impersonating usernames.
💻 Affected Systems
- MediaWiki
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create usernames that impersonate legitimate users or administrators, leading to social engineering attacks, privilege escalation, or confusion in collaborative environments.
Likely Case
Malicious users bypass username validation to create misleading accounts that appear similar to legitimate users, potentially causing confusion or minor disruption.
If Mitigated
With proper access controls and monitoring, impact is limited to minor confusion that can be quickly identified and corrected.
🎯 Exploit Status
Exploitation requires the 'override-antispoof' permission, which is typically granted to administrators or trusted users.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.37.2 or later
Vendor Advisory: https://phabricator.wikimedia.org/T304126
Restart Required: No
Instructions:
1. Update MediaWiki to version 1.37.2 or later. 2. If using the AntiSpoof extension, ensure it's updated to the latest version. 3. No server restart required for MediaWiki updates.
🔧 Temporary Workarounds
Disable AntiSpoof Extension
allTemporarily disable the AntiSpoof extension until patching is possible
Edit LocalSettings.php and remove or comment out: wfLoadExtension('AntiSpoof');
Restrict override-antispoof Permission
allTighten access controls for the override-antispoof permission
Edit LocalSettings.php and add: $wgGroupPermissions['sysop']['override-antispoof'] = false;
🧯 If You Can't Patch
- Review and audit all users with 'override-antispoof' permission
- Implement additional username validation and monitoring
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version and AntiSpoof extension status in LocalSettings.phpCheck Version:
Check the bottom of any MediaWiki page for version information or run: grep 'wgVersion' includes/DefaultSettings.phpVerify Fix Applied:
Verify MediaWiki version is 1.37.2 or later and check that username spoofing prevention works correctly📡 Detection & Monitoring
Log Indicators:
- Unusual username creation patterns
- Multiple username creation attempts with similar names
- Users with override-antispoof permission creating suspicious usernames
Network Indicators:
- Increased account creation requests
- Patterns of similar username registrations
SIEM Query:
source="mediawiki_logs" AND (event="account_creation" AND username MATCHES "*similar*pattern*")🔗 References
- https://gerrit.wikimedia.org/r/q/Id8c4e2e336695ce70ccdf8a51ad729bf4a99f8f7
- https://phabricator.wikimedia.org/T304126
- https://security.gentoo.org/glsa/202305-24
- https://gerrit.wikimedia.org/r/q/Id8c4e2e336695ce70ccdf8a51ad729bf4a99f8f7
- https://phabricator.wikimedia.org/T304126
- https://security.gentoo.org/glsa/202305-24
