CVE-2023-45371
📋 TL;DR
This vulnerability allows attackers to perform unlimited item merging operations in Wikibase, potentially disrupting data integrity and availability. It affects MediaWiki installations with the Wikibase extension running vulnerable versions. Any user with item merging permissions can exploit this lack of rate limiting.
💻 Affected Systems
- MediaWiki with Wikibase extension
📦 What is this software?
Mediawiki by Mediawiki
Mediawiki by Mediawiki
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Malicious actors could merge all items in the database, causing permanent data loss, service disruption, and requiring complete restoration from backups.
Likely Case
Attackers could merge significant numbers of items, creating data inconsistencies, broken links, and requiring manual cleanup operations.
If Mitigated
With proper rate limiting controls, impact would be limited to occasional legitimate merging operations with minimal disruption.
🎯 Exploit Status
Exploitation requires authentication with item merging permissions. Simple script can automate merging operations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.35.12, 1.39.5, 1.40.1 or later
Vendor Advisory: https://phabricator.wikimedia.org/T345064
Restart Required: No
Instructions:
1. Update MediaWiki to patched version. 2. Update Wikibase extension. 3. Clear caches if applicable.
🔧 Temporary Workarounds
Implement custom rate limiting
allAdd rate limiting for item merging operations via MediaWiki configuration or extension hooks
Configure $wgRateLimits in LocalSettings.php with appropriate limits for 'mergeitem' action
Restrict merging permissions
allTemporarily remove item merging permissions from non-essential users
Modify user group permissions to remove 'item-merge' right
🧯 If You Can't Patch
- Implement strict monitoring of item merging operations and alert on unusual patterns
- Reduce number of users with item merging permissions to absolute minimum
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version and Wikibase extension version against affected rangesCheck Version:
Check MediaWiki version in includes/DefaultSettings.php or via Special:Version pageVerify Fix Applied:
Verify MediaWiki version is 1.35.12+, 1.39.5+, or 1.40.1+ and test item merging with rate limiting📡 Detection & Monitoring
Log Indicators:
- High frequency of 'mergeitem' actions in MediaWiki logs
- Multiple item merges from single user in short timeframe
Network Indicators:
- Unusual API call patterns to item merging endpoints
SIEM Query:
source="mediawiki" action="mergeitem" | stats count by user | where count > threshold