CVE-2023-45361

Executive Summary

CVE-2023-45361 is a denial-of-service (DoS) vulnerability in the Vector skin component of MediaWiki, a widely used open-source wiki platform. The flaw resides in the VectorComponentUserLinks.php file, where an uncaught MalformedTitleException can be triggered by providing a malformed vector-intro-page title. This leads to an unhandled exception, causing the web server to return an incorrect or blank page, effectively denying service to legitimate users. The vulnerability affects MediaWiki versions before 1.39.5 and 1.40.x before 1.40.1. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating a low likelihood of exploitation in the wild. However, the attack vector is network-based and requires no authentication, making it a potential risk for unpatched instances.

Supply Chain & Package Security

MediaWiki is a PHP-based application typically deployed via manual installation or package managers like Composer. The Vector skin is a core component bundled with MediaWiki. Administrators should ensure they are using the latest patched versions (1.39.5 or 1.40.1) and verify the integrity of their installation files. No specific supply chain compromise has been reported for this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Base Score: 5.3 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): Low (L) – The vulnerability can cause a denial of service by returning incorrect web pages.

Threat Level: Medium. While the impact is limited to availability, the ease of exploitation (no auth, network-based) makes it a viable vector for disrupting wiki services.

Deep Dive & Mechanics

The vulnerability is located in the VectorComponentUserLinks.php file, which is part of the Vector skin. This component handles the rendering of user links (e.g., "My talk", "Preferences") in the wiki interface. The vector-intro-page is a configuration option that allows administrators to set a custom introductory page for the Vector skin.

When the skin processes the vector-intro-page value, it attempts to create a Title object from the provided string. If the string is malformed (e.g., contains invalid characters or syntax), the Title::newFromText() method throws a MalformedTitleException. In vulnerable versions, this exception is not caught, leading to an unhandled exception that disrupts the page rendering process. The result is an incorrect or blank web page being served to the user, effectively causing a denial of service.

The fix involves wrapping the title creation logic in a try-catch block to handle the MalformedTitleException gracefully, allowing the page to render normally even if the title is invalid.

Vulnerable vs. Patched Code

Vulnerable Code (MediaWiki < 1.39.5 / < 1.40.1):

// VectorComponentUserLinks.php (simplified)
$introPageTitle = Title::newFromText( $this->getConfig()->get( 'VectorIntroPage' ) );
// No try-catch, so MalformedTitleException propagates

Patched Code (MediaWiki >= 1.39.5 / >= 1.40.1):

// VectorComponentUserLinks.php (simplified)
try {
    $introPageTitle = Title::newFromText( $this->getConfig()->get( 'VectorIntroPage' ) );
} catch ( MalformedTitleException $e ) {
    // Handle gracefully, e.g., log the error and set $introPageTitle to null
    $introPageTitle = null;
}

The patch ensures that even if the vector-intro-page configuration is malformed, the exception is caught and the page continues to render without disruption.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable MediaWiki instance (version < 1.39.5 or 1.40.x < 1.40.1) with the Vector skin enabled.
• Network access to the wiki.

Exploitation Steps:

1. Identify the target MediaWiki instance (e.g., via Shodan or manual browsing).
2. Craft a request that triggers the MalformedTitleException. This can be done by setting the vector-intro-page parameter to a malformed title via the wiki's configuration or by manipulating the request if the parameter is exposed.
   • Example: https://target/wiki/Special:Preferences?vector-intro-page=[[Invalid%20Title
3. Send the request. The server will return an error page or a blank page, indicating a successful DoS.

Note: No public exploit code is available. The above is a conceptual approach.

Blue Team

Detection:

• Monitor web server logs for repeated requests containing malformed vector-intro-page parameters.
• Look for HTTP 500 errors or unusual response patterns (e.g., blank pages) from the wiki.
• Use the Sigma rule below to detect exploitation attempts.

Mitigation:

• Immediately upgrade to MediaWiki 1.39.5 or 1.40.1.
• If upgrading is not possible, apply the patch manually by modifying VectorComponentUserLinks.php to catch the exception.
• Restrict access to the wiki's configuration pages to trusted users only.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing vector-intro-page with malformed title syntax (e.g., [[, {{, |).
  • HTTP 500 error responses from the wiki server.
• Logs:
  • PHP error logs showing MalformedTitleException with stack traces referencing VectorComponentUserLinks.php.
  • Web server access logs showing repeated requests to /wiki/Special:Preferences or similar endpoints with unusual parameters.
• System:
  • Unusual CPU or memory spikes on the web server due to exception handling overhead (though unlikely for this specific CVE).

Detection Engineering

YARA Rule

rule CVE_2023_45361_MediaWiki_Vector_DoS {
    meta:
        description = "Detects exploitation attempts of CVE-2023-45361 in MediaWiki Vector skin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-45361"
    strings:
        $malformed_title = /vector-intro-page[=:].*[\[\]\{\}\|]/ nocase
        $error_pattern = "MalformedTitleException"
    condition:
        $malformed_title or $error_pattern
}

Sigma Rule

title: CVE-2023-45361 MediaWiki Vector Skin DoS Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2023-45361 by sending malformed vector-intro-page parameters.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'vector-intro-page'
        cs-uri-query|re: '.*[\[\]\{\}\|].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in page titles (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45361 MediaWiki Vector Skin DoS Attempt"; flow:to_server,established; content:"vector-intro-page"; http_uri; pcre:"/[\[\]\{\}\|]/Ri"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MediaWiki: Update to version 1.39.5 or 1.40.1 (or later) to receive the official patch.
2. Apply Manual Patch: If upgrading is not feasible, modify VectorComponentUserLinks.php to catch MalformedTitleException as shown in the patched code section.
3. Restrict Configuration Access: Limit who can modify the vector-intro-page setting to trusted administrators only.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) to filter malformed requests.
• Regularly update MediaWiki and all extensions/skins.
• Monitor security advisories from MediaWiki and the broader open-source community.

Valters IT Signature:

Valters IT - DevSecOps & CTI Expert