CVE-2022-29904
📋 TL;DR
This CVE describes an SQL injection vulnerability in the SemanticDrilldown extension for MediaWiki. Attackers can exploit certain '-' and '_' constraints to execute arbitrary SQL commands. All MediaWiki installations using vulnerable versions of SemanticDrilldown are affected.
💻 Affected Systems
- MediaWiki SemanticDrilldown extension
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise allowing data theft, modification, or deletion; potential privilege escalation to administrative access; remote code execution if database permissions allow.
Likely Case
Unauthorized data access and extraction from MediaWiki database, potentially exposing user information, page content, and configuration data.
If Mitigated
Limited impact if proper input validation and database permissions are enforced, though SQL injection could still expose some data.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited; specific exploit details may not be publicly available but the vulnerability type is well-understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit e688bdba6434591b5dff689a45e4d53459954773 or later
Vendor Advisory: https://phabricator.wikimedia.org/T306463
Restart Required: No
Instructions:
1. Update SemanticDrilldown extension to commit e688bdba6434591b5dff689a45e4d53459954773 or later. 2. Apply the patch from gerrit.wikimedia.org/r/c/mediawiki/extensions/SemanticDrilldown/+/785213. 3. Clear any caches if applicable.
🔧 Temporary Workarounds
Disable SemanticDrilldown extension
allTemporarily disable the vulnerable extension until patching is possible
Edit LocalSettings.php and comment out or remove: wfLoadExtension('SemanticDrilldown');
Implement WAF rules
allAdd web application firewall rules to block SQL injection patterns
🧯 If You Can't Patch
- Implement strict input validation for all user inputs to SemanticDrilldown
- Apply principle of least privilege to database user accounts used by MediaWiki
🔍 How to Verify
Check if Vulnerable:
Check SemanticDrilldown extension version: grep -r 'SemanticDrilldown' /path/to/mediawiki/extensions/Check Version:
Check MediaWiki version: grep 'wgVersion' /path/to/mediawiki/includes/DefaultSettings.phpVerify Fix Applied:
Verify extension is updated to commit e688bdba6434591b5dff689a45e4d53459954773 or later📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts or unusual parameter patterns in web server logs
Network Indicators:
- HTTP requests containing SQL injection patterns in parameters
- Unusual database connection patterns
SIEM Query:
search 'web_server_logs' AND ('sql' OR 'union' OR 'select' OR '--' OR ';') AND 'SemanticDrilldown'