CVE-2022-29906
📋 TL;DR
This vulnerability allows attackers to bypass authorization checks in the QuizGame extension for MediaWiki, granting unauthorized access to admin API functions. Any MediaWiki installation with the QuizGame extension enabled is affected. Attackers can perform administrative actions without proper authentication.
💻 Affected Systems
- MediaWiki QuizGame Extension
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the MediaWiki instance through unauthorized administrative actions, potentially leading to data manipulation, privilege escalation, or site defacement.
Likely Case
Unauthorized users gain administrative privileges within the QuizGame extension, allowing them to manipulate quiz content, user scores, or game settings.
If Mitigated
Limited impact if proper network segmentation and access controls prevent unauthorized users from reaching the vulnerable endpoint.
🎯 Exploit Status
Exploitation requires access to the admin API endpoint but bypasses the quizadmin user check. No authentication is required for the vulnerable check.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki QuizGame extension commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66 or later
Vendor Advisory: https://phabricator.wikimedia.org/T302199
Restart Required: No
Instructions:
1. Update MediaWiki to version 1.37.3 or later. 2. Update QuizGame extension to commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66 or later. 3. Clear MediaWiki cache if applicable.
🔧 Temporary Workarounds
Disable QuizGame Extension
allTemporarily disable the vulnerable QuizGame extension until patching is possible.
Edit LocalSettings.php and comment out or remove: wfLoadExtension('QuizGame');
Restrict API Access
linuxImplement network-level restrictions to limit access to the admin API endpoint.
Configure web server (Apache/Nginx) to restrict access to /api.php endpoints to trusted IPs only.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the MediaWiki instance.
- Monitor admin API logs for unauthorized access attempts and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check if QuizGame extension is enabled and version is before commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66.Check Version:
Check MediaWiki's Special:Version page or examine extension files for commit hash.Verify Fix Applied:
Verify QuizGame extension is updated to commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66 or later.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to QuizGame admin API endpoints
- Unexpected quizadmin privilege usage
Network Indicators:
- Unusual API requests to /api.php with quiz-related parameters
SIEM Query:
source="mediawiki.log" AND ("QuizGame" OR "quizadmin") AND ("unauthorized" OR "admin" OR "api")