CVE-2024-29883

Executive Summary

CVE-2024-29883 is a vulnerability in the CreateWiki extension for MediaWiki, developed by Miraheze. The flaw resides in the suppression mechanism for wiki requests. When a wiki request is suppressed, the intended behavior is to restrict visibility based on configurable user rights. However, due to a logic error, suppression always restricts visibility to users with the (createwiki) user right, regardless of the settings applied. This can lead to unauthorized disclosure of sensitive information, such as the existence and details of suppressed wiki requests, to users who should not have access.

This vulnerability has a CVSS score of 4.9 (Medium) and a low EPSS score of 0.0%, indicating that exploitation is not currently widespread. However, the potential for information disclosure makes it a concern for organizations using the CreateWiki extension.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby). It is a MediaWiki extension hosted on GitHub and distributed via the Miraheze repository. The supply chain risk is limited to the extension's codebase and its dependencies.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.9 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid user account with the (createwiki) right.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability allows information disclosure but requires a valid account with specific privileges.

Deep Dive & Mechanics

The CreateWiki extension allows users to request new wikis. Administrators can suppress these requests to hide them from public view. The suppression feature is intended to be configurable, allowing administrators to set which user groups can view suppressed requests.

The vulnerability arises from a flaw in the permission check logic. When a suppressed wiki request is accessed, the code incorrectly checks for the (createwiki) user right instead of the configured suppression visibility settings. This means that any user with the (createwiki) right can view all suppressed requests, regardless of the intended restrictions.

Root Cause: The permission check function userCan or equivalent does not properly evaluate the suppression settings. It defaults to checking for the (createwiki) right, bypassing the custom visibility configuration.

Impact: An attacker with a low-privileged account that has the (createwiki) right (e.g., a wiki requester) can enumerate all suppressed wiki requests, potentially gaining insight into private or sensitive wiki creation activities.

Vulnerable vs. Patched Code

The exact vulnerable code is not publicly available, but the logic flaw can be described:

Vulnerable Code (Conceptual):

// In the suppression check function
if ( $user->isAllowed( 'createwiki' ) ) {
    // Show suppressed request
    return true;
}
// Else, hide
return false;

Patched Code (Conceptual):

// In the suppression check function
$suppressionLevel = $request->getSuppressionLevel();
if ( $user->isAllowed( $suppressionLevel ) ) {
    // Show suppressed request
    return true;
}
// Else, hide
return false;

The patched version uses the configured suppression level (e.g., 'suppresswiki' or a custom right) instead of hardcoding 'createwiki'.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A MediaWiki instance with the CreateWiki extension installed.
• A user account with the (createwiki) right (e.g., a wiki requester).
• Access to the wiki request list (e.g., Special:RequestWiki).

Exploitation Steps:

1. Log in with the low-privileged account.
2. Navigate to Special:RequestWiki or the wiki request queue.
3. Access a suppressed request (e.g., by manipulating the request ID in the URL).
4. The suppressed request will be displayed, revealing its details.

Example URL Manipulation:

https://wiki.example.com/wiki/Special:RequestWiki/123

Where 123 is the ID of a suppressed request.

Blue Team

Detection:

• Monitor access logs for unusual patterns in requests to Special:RequestWiki or similar endpoints.
• Look for users with the (createwiki) right accessing suppressed requests.
• Audit the logging table for entries related to suppressed request views.

Prevention:

• Restrict the (createwiki) right to only trusted users.
• Implement additional logging for suppressed request access.
• Apply the vendor's patch or manually fix the permission check logic.

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests to /wiki/Special:RequestWiki/* from users with the (createwiki) right.
  • Unusual access patterns to suppressed wiki request pages.

• Host:

  • Log entries in MediaWiki's logging table with log_type = 'createwiki' and log_action = 'suppress' or similar.
  • Database queries showing suppressed requests being accessed by unauthorized users.

• File:

  • Modified or patched files in the CreateWiki extension directory (e.g., includes/RequestWiki.php).

Detection Engineering

YARA Rule

rule Detect_CreateWiki_Suppression_Bypass {
    meta:
        description = "Detects potential exploitation of CVE-2024-29883 by identifying access to suppressed wiki requests"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-29883"
    strings:
        $s1 = "Special:RequestWiki" nocase
        $s2 = "suppress" nocase
        $s3 = "createwiki" nocase
    condition:
        all of ($s1, $s2, $s3)
}

Sigma Rule

title: CreateWiki Suppression Bypass Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects access to suppressed wiki requests by users with the createwiki right
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29883
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "Special:RequestWiki"
        cs-username|contains: "createwiki"
    condition: selection
falsepositives:
    - Legitimate administrators accessing suppressed requests
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29883 - CreateWiki Suppression Bypass"; flow:to_server,established; content:"Special:RequestWiki"; http_uri; content:"createwiki"; http_cookie; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict the (createwiki) right: Only grant this right to trusted administrators.
2. Audit current users: Review all users with the (createwiki) right and remove unnecessary ones.
3. Monitor logs: Enable detailed logging for suppressed request access.

Long-term Fix:

1. Apply vendor patch: Once available, update the CreateWiki extension to the patched version.
2. Manual code fix: If no patch is available, modify the permission check logic in the extension to use the configured suppression level instead of hardcoding 'createwiki'.

Workaround:

• Disable the suppression feature entirely if not needed, or implement a custom permission check via a MediaWiki hook.

Valters IT