CVE-2024-29898

Executive Summary

CVE-2024-29898 is a vulnerability in the CreateWiki extension for MediaWiki, developed by Miraheze. This flaw arises from an incomplete patch for a previous vulnerability (CVE-2024-29897), which may have inadvertently exposed suppressed wiki requests to unauthorized users. Specifically, private wikis that added Special:RequestWikiQueue to their read whitelist could leak suppressed requests to users without the (read) permission. The vulnerability has a CVSS score of 4.9 (Medium), indicating a moderate risk of information disclosure. No public proof-of-concept (PoC) or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a MediaWiki extension (CreateWiki) used within the Miraheze ecosystem. The risk is limited to MediaWiki instances that have the CreateWiki extension installed and configured with private wikis that whitelist Special:RequestWikiQueue.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid account with minimal privileges.
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – suppressed wiki requests are exposed.
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows information disclosure of suppressed wiki requests, which could include sensitive data about wiki creation requests. However, exploitation requires an authenticated user and a specific configuration (private wiki with Special:RequestWikiQueue whitelisted).

Deep Dive & Mechanics

The CreateWiki extension manages wiki creation requests via Special:RequestWikiQueue. In a private wiki, access to this page is typically restricted to users with the (read) permission. However, due to an oversight in the patch for CVE-2024-29897, the authorization check was not properly applied to suppressed requests. When a private wiki adds Special:RequestWikiQueue to its read whitelist (to allow certain users to view requests), the suppression status of requests is not enforced. This means that a user without (read) permission who can access the whitelisted page can see suppressed requests that should be hidden.

The root cause is a missing authorization check in the code that handles the display of suppressed requests. The patch for CVE-2024-29897 aimed to fix a similar issue but inadvertently left this gap.

Vulnerable vs. Patched Code

The vulnerability is fixed in commit 8f8442ed5299510ea3e58416004b9334134c149c. The exact code changes are not publicly detailed, but the fix likely adds an authorization check to ensure that suppressed requests are only visible to users with the appropriate permissions, even if the page is whitelisted.

Vulnerable Code (Conceptual):

// In the function that displays requests from Special:RequestWikiQueue
// No check for suppression status when page is whitelisted
$requests = getRequests();
foreach ($requests as $request) {
    // Display request regardless of suppression status
    echo $request->getDetails();
}

Patched Code (Conceptual):

// In the function that displays requests from Special:RequestWikiQueue
// Check if the user has permission to view suppressed requests
$requests = getRequests();
foreach ($requests as $request) {
    if ($request->isSuppressed() && !$user->isAllowed('suppressrequest')) {
        continue; // Skip suppressed requests
    }
    echo $request->getDetails();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A MediaWiki instance with the CreateWiki extension installed and vulnerable version.
• A private wiki that has Special:RequestWikiQueue whitelisted for read access.
• A user account without the (read) permission but with access to the whitelisted page.

Exploitation Steps:

1. Log in as the low-privilege user.
2. Navigate to Special:RequestWikiQueue on the private wiki.
3. Observe that suppressed wiki requests are visible, which should be hidden.

Note: No public exploit code is available. This is a logic flaw, not a code injection.

Blue Team

Detection:

• Monitor access logs for Special:RequestWikiQueue from users without the (read) permission.
• Check for unusual access patterns to this page from low-privilege accounts.

Mitigation:

• Apply the patch from commit 8f8442ed5299510ea3e58416004b9334134c149c.
• Review the whitelist configuration for Special:RequestWikiQueue on private wikis.
• Ensure that only trusted users have access to this page.

Indicators of Compromise (IOCs)

• Log Entry: Access to Special:RequestWikiQueue by a user without (read) permission.
• Network Traffic: HTTP requests to /wiki/Special:RequestWikiQueue from authenticated sessions with low privileges.
• File Hash: Not applicable (no malicious files).

Detection Engineering

YARA Rule

rule Detect_CVE_2024_29898_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-29898 by accessing Special:RequestWikiQueue without proper permissions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-29898"
    strings:
        $url = "Special:RequestWikiQueue" nocase
        $suppressed = "suppressed" nocase
    condition:
        $url and #suppressed > 0
}

Sigma Rule

title: CVE-2024-29898 - Unauthorized Access to Special:RequestWikiQueue
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects access to Special:RequestWikiQueue by users without read permission on private wikis
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29898
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "Special:RequestWikiQueue"
        cs-username|exists: true
    condition: selection
falsepositives:
    - Legitimate access by users with read permission
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29898 - Unauthorized Access to Special:RequestWikiQueue"; flow:to_server,established; content:"Special:RequestWikiQueue"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Apply the patch from commit 8f8442ed5299510ea3e58416004b9334134c149c to the CreateWiki extension.
2. Configuration: Review and restrict the whitelist for Special:RequestWikiQueue on private wikis. Only add it if absolutely necessary.
3. Monitoring: Enable logging for access to Special:RequestWikiQueue and monitor for unauthorized access.
4. User Permissions: Ensure that only trusted users have the (read) permission on private wikis.
5. Update: Keep the CreateWiki extension up to date with the latest security patches.

Valters IT
Securing Digital Frontiers