CVE-2022-29547
📋 TL;DR
The CreateRedirect extension for MediaWiki before April 14, 2022 fails to properly verify user permissions when creating redirects, allowing unauthorized or blocked users to edit pages they shouldn't have access to. This affects any MediaWiki installation using the vulnerable CreateRedirect extension version.
💻 Affected Systems
- MediaWiki CreateRedirect extension
📦 What is this software?
Createredirect by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized users could modify critical pages, inject malicious content, deface the wiki, or redirect legitimate pages to malicious destinations.
Likely Case
Low-privilege users or blocked users could make unauthorized edits to protected pages, potentially disrupting wiki operations or spreading misinformation.
If Mitigated
With proper access controls and monitoring, impact is limited to minor unauthorized edits that can be quickly detected and reverted.
🎯 Exploit Status
Exploitation requires some user access (not completely unauthenticated), but the permission bypass makes it trivial for users with any level of access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version from 2022-04-14 or later
Vendor Advisory: https://phabricator.wikimedia.org/T306174
Restart Required: No
Instructions:
1. Update the CreateRedirect extension to version from 2022-04-14 or later. 2. Replace the extension files with the patched version from the official MediaWiki repository. 3. No server restart required for MediaWiki extensions.
🔧 Temporary Workarounds
Disable CreateRedirect extension
allTemporarily disable the vulnerable extension until patching is possible
Remove or comment out 'wfLoadExtension( 'CreateRedirect' );' from LocalSettings.php
Restrict user permissions
allTighten overall user permissions to limit potential damage
🧯 If You Can't Patch
- Implement strict monitoring of page edits and redirect creations
- Increase logging and alerting for unauthorized edit attempts
🔍 How to Verify
Check if Vulnerable:
Check if CreateRedirect extension is enabled and its version date is before 2022-04-14Check Version:
Check extension.json or similar version file in the CreateRedirect extension directoryVerify Fix Applied:
Verify the extension files have been updated to 2022-04-14 version or later📡 Detection & Monitoring
Log Indicators:
- Unauthorized edit attempts on protected pages
- Redirect creations by low-privilege users
Network Indicators:
- Unusual edit patterns from user accounts
SIEM Query:
Search for edit events where user permission level doesn't match page protection level🔗 References
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CreateRedirect/+/780567
- https://phabricator.miraheze.org/T9061
- https://phabricator.wikimedia.org/T306174
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/CreateRedirect/+/780567
- https://phabricator.miraheze.org/T9061
- https://phabricator.wikimedia.org/T306174
