CVE-2024-47849
📋 TL;DR
This SQL injection vulnerability in MediaWiki's Cargo extension allows attackers to execute arbitrary SQL commands on the database. It affects MediaWiki installations using the Cargo extension version 3.6.X before 3.6.1. Attackers could potentially read, modify, or delete database contents.
💻 Affected Systems
- MediaWiki Cargo extension
📦 What is this software?
Cargo by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the MediaWiki application.
If Mitigated
Limited impact with proper input validation and database permissions, potentially only allowing data reading from accessible tables.
🎯 Exploit Status
SQL injection vulnerabilities typically have low exploitation complexity. The vulnerability appears to require some level of access to MediaWiki functions that use Cargo.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.1
Vendor Advisory: https://phabricator.wikimedia.org/T368628
Restart Required: No
Instructions:
1. Update the Cargo extension to version 3.6.1 or later. 2. For MediaWiki installations using Composer: run 'composer update mediawiki/cargo'. 3. For manual installations: download and replace the Cargo extension files from the official repository.
🔧 Temporary Workarounds
Disable Cargo Extension
allTemporarily disable the Cargo extension if immediate patching is not possible.
Edit LocalSettings.php and remove or comment out: wfLoadExtension('Cargo');
Web Application Firewall
allImplement WAF rules to block SQL injection patterns targeting Cargo endpoints.
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries for all Cargo-related functionality
- Restrict database user permissions to minimum required for Cargo operations
🔍 How to Verify
Check if Vulnerable:
Check Cargo extension version in MediaWiki's Special:Version page or examine the Cargo extension directory for version files.Check Version:
grep -r 'CARGO_VERSION' /path/to/mediawiki/extensions/Cargo/ || cat /path/to/mediawiki/extensions/Cargo/extension.json | grep versionVerify Fix Applied:
Verify Cargo extension version is 3.6.1 or later via Special:Version page or check that the vulnerability-specific code changes from the patch are present.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by Cargo-related requests
- Requests with SQL syntax in Cargo-related parameters
Network Indicators:
- Unusual patterns of requests to Cargo API endpoints
- Requests containing SQL keywords like UNION, SELECT, INSERT in URL parameters
SIEM Query:
source="web_server_logs" AND (url="*Cargo*" OR url="*cargo*") AND (param="*UNION*" OR param="*SELECT*" OR param="*INSERT*")