CVE-2024-40596
📋 TL;DR
The CheckUser extension for MediaWiki has a vulnerability where the Special:Investigate feature can expose suppressed log event information that should remain hidden. This affects MediaWiki administrators and users with CheckUser privileges who can access sensitive suppressed data. The issue occurs because TimelineService doesn't properly handle suppression of sensitive information.
💻 Affected Systems
- MediaWiki with CheckUser extension
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Unauthorized disclosure of sensitive suppressed information including private user data, administrative actions, or security-related logs that should remain confidential.
Likely Case
Privileged users inadvertently or intentionally viewing suppressed log information that should be restricted, potentially violating privacy policies or exposing sensitive administrative actions.
If Mitigated
Limited exposure to authorized administrators only, with proper access controls and auditing preventing widespread data disclosure.
🎯 Exploit Status
Exploitation requires CheckUser privileges to access the Special:Investigate feature.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CheckUser extension version with fix for T326866
Vendor Advisory: https://phabricator.wikimedia.org/T326866
Restart Required: No
Instructions:
Update MediaWiki to latest version
Update CheckUser extension to patched version
Clear caches if necessary
🔧 Temporary Workarounds
Disable CheckUser extension
allTemporarily disable the CheckUser extension to prevent exploitation
Edit LocalSettings.php and comment out or remove wfLoadExtension('CheckUser');
Restrict CheckUser privileges
allTemporarily remove CheckUser privileges from non-essential users
Edit LocalSettings.php to modify $wgGroupPermissions array for 'checkuser' group
🧯 If You Can't Patch
- Restrict access to Special:Investigate feature to only essential administrators
- Implement additional logging and monitoring for CheckUser feature usage
🔍 How to Verify
Check if Vulnerable:
Check if MediaWiki version is 1.42.1 or earlier with CheckUser extension enabled and Special:Investigate feature accessibleCheck Version:
Check MediaWiki version via Special:Version page or $wgVersion in LocalSettings.phpVerify Fix Applied:
Verify CheckUser extension has been updated to version containing fix for T326866 and test Special:Investigate feature📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to Special:Investigate
- Multiple suppressed log view events
- CheckUser feature usage by non-standard users
Network Indicators:
- HTTP requests to /wiki/Special:Investigate endpoint
SIEM Query:
source="mediawiki_logs" AND (uri_path="/wiki/Special:Investigate" OR action="investigate")