CVE-2024-40597
📋 TL;DR
The CheckUser extension for MediaWiki fails to respect the log_deleted attribute, allowing unauthorized users to view suppressed log information. This affects MediaWiki installations with the CheckUser extension enabled, potentially exposing sensitive administrative actions and user data that should remain hidden.
💻 Affected Systems
- MediaWiki with CheckUser extension
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access suppressed logs containing sensitive user information, administrative actions, or security-related events that should remain confidential, leading to privacy violations and potential targeted attacks.
Likely Case
Unauthorized users with access to the CheckUser interface can view log entries that should be suppressed, exposing information about user blocks, deletions, or other administrative actions.
If Mitigated
With proper access controls limiting CheckUser functionality to trusted administrators only, the impact is reduced to potential insider threats or compromised administrator accounts.
🎯 Exploit Status
Exploitation requires access to the CheckUser interface, which typically requires special permissions. The vulnerability is straightforward to exploit once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CheckUser extension version with fix applied
Vendor Advisory: https://phabricator.wikimedia.org/T326865
Restart Required: No
Instructions:
1. Update MediaWiki to latest version. 2. Update CheckUser extension to patched version. 3. Clear MediaWiki caches if necessary.
🔧 Temporary Workarounds
Disable CheckUser extension
allTemporarily disable the CheckUser extension to prevent exploitation
Edit LocalSettings.php and comment out or remove wfLoadExtension('CheckUser');
Restrict CheckUser permissions
allLimit CheckUser access to only essential administrators
Edit LocalSettings.php to modify $wgGroupPermissions array for checkuser group
🧯 If You Can't Patch
- Restrict CheckUser permissions to minimal necessary administrators only
- Implement additional logging and monitoring for CheckUser access attempts
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version and CheckUser extension version. If MediaWiki ≤ 1.42.1 with CheckUser extension, assume vulnerable.Check Version:
Check MediaWiki version in includes/DefaultSettings.php or via Special:Version pageVerify Fix Applied:
Verify CheckUser extension respects log_deleted flag by testing with suppressed log entries.📡 Detection & Monitoring
Log Indicators:
- Unusual CheckUser queries, especially for suppressed log entries
- Multiple failed permission checks for CheckUser access
Network Indicators:
- HTTP requests to CheckUser special pages from unauthorized users
SIEM Query:
source="mediawiki" AND (uri_path="/wiki/Special:CheckUser" OR message="CheckUser") AND user NOT IN [authorized_admin_list]