CVE-2021-29483

METADATA VENDOR_NAME: Miraheze AFFECTED_VERSION: Unknown MITRE_TACTIC: T1190 — Exploit Public-Facing Application SHODAN_DORKS: ["mediawiki managewiki", "wikiconfig", "api.php?action=wikiconfig"] CWE_ID: N/A CVSS_VECTOR: N/A POC_STATUS: None PATCH_DETAILS: https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch

Executive Summary

CVE-2021-29483 is an information disclosure vulnerability in the ManageWiki extension for the MediaWiki project. The 'wikiconfig' API leaked the value of private configuration variables set through ManageWiki to all users. Affected organizations running MediaWiki instances with ManageWiki enabled face exposure of sensitive configuration data, rated at CVSS 9.4. The issue was addressed via a specific commit patch, with workarounds including disabling the API module.

Technical Analysis

The vulnerability stems from the 'wikiconfig' API endpoint in ManageWiki, which inadvertently exposed private configuration variables. According to the CNA title and NVD description, the API returned values of variables marked as private when queried. This constitutes an information disclosure flaw where access controls on configuration data were not enforced for API consumers. The attack surface is the publicly accessible MediaWiki API (api.php), allowing any authenticated or unauthenticated user depending on site settings to retrieve restricted settings. No additional code-level function names beyond the explicitly stated 'wikiconfig' API and ManageWiki variable handling are provided in the source data. The flaw class is improper access control on configuration retrieval via API, leading to leakage without requiring elevated privileges.

Exploitation Scenarios

Attack chain for this vulnerability, derived strictly from the NVD description:

1. Reconnaissance/target identification: Identify MediaWiki deployments exposing the ManageWiki extension through standard service enumeration or search for instances where ManageWiki is active.
2. How the specific flaw class is triggered: Issue a request to the 'wikiconfig' API, which by design queries ManageWiki-stored variables without filtering private ones.
3. Payload/execution method at the vulnerability-class level: The API call itself serves as the trigger, returning private configuration values in the response due to missing access restrictions on the ManageWiki variable set.
4. Post-exploitation impact: Attacker obtains leaked private config data for further reconnaissance or credential harvesting. No public PoC available; attack chain is inferred from vulnerability class.

Impact Assessment

Business impact includes unauthorized disclosure of internal configuration, potentially revealing database credentials, API keys, or other sensitive parameters stored via ManageWiki. Affected systems are MediaWiki installations using the ManageWiki extension prior to the referenced patch. Blast radius extends to any site allowing API access, amplifying risk in shared or public wikis. The CVSS 9.4 score reflects high confidentiality impact with network accessibility and no required privileges in the described scenario. No CISA KEV listing or in-the-wild exploitation evidence is recorded.

Detection Guidance

Sigma Rule

title: MediaWiki ManageWiki wikiconfig API Access
id: 8f4e2c1a-9b3d-4e7f-a1c2-5d6e8f9a0b1c
status: experimental
description: Detects access to wikiconfig API module
logsource:
  product: webserver
  service: access
detection:
  selection:
    http.request.uri|contains: "action=wikiconfig"
  condition: selection
fields:
  - client_ip
  - http.request.uri
level: medium

YARA Rule

rule MediaWiki_ManageWiki_wikiconfig_Leak {
    meta:
        description = "Detects references to wikiconfig API in MediaWiki context"
        author = "valtersit.com"
    strings:
        $api = "action=wikiconfig"
        $ext = "ManageWiki"
    condition:
        $api or $ext
}

Suricata IDS Rule

alert http any any -> any any (msg:"ManageWiki wikiconfig API Request"; flow:established,to_server; http.uri; content:"action=wikiconfig"; classtype:web-application-attack; sid:1000001; rev:1;)

Elastic Detection

sequence by source.ip
  [http where url.path like "*api.php*" and url.query like "*action=wikiconfig*"]

Splunk SPL Query

index=web sourcetype=access_combined uri="*action=wikiconfig*" | stats count by clientip, uri

Wazuh OSSEC Rule

<rule id="100001" level="8">
  <if_sid>31100</if_sid>
  <match>action=wikiconfig</match>
  <description>ManageWiki wikiconfig API access detected</description>
</rule>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations: Set $wgAPIListModules['wikiconfig'] = 'ApiQueryDisabled'; or remove private config variables from ManageWiki.
2. Patch/upgrade steps: Apply the commit at https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch to the ManageWiki extension.
3. Long-term hardening: Restrict API access to authenticated administrators only and audit all ManageWiki configuration variables for privacy flags.

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-29483 GitHub patch: https://github.com/miraheze/ManageWiki/compare/99f3b2c8af18...befb83c66f5b.patch MediaWiki extension documentation on ManageWiki No known threat actor campaigns or exploit-in-the-wild evidence recorded in CISA KEV or public sources.