CVE-2024-47816

Executive Summary

CVE-2024-47816 is an improper authentication vulnerability in the MediaWiki ImportDump extension. The extension stores a user's local actor ID in the database to track who made import requests. If a user on another wiki within the same MediaWiki farm happens to have the same actor ID as a user on the central wiki, the remote user can impersonate the central wiki user. This allows unauthorized actions such as creating new comments, editing import requests, and viewing private requests. The CVSS score is 6.4 (Medium), with low confidentiality and integrity impact, and no availability impact. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating very low exploitation likelihood at this time.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a MediaWiki extension (ImportDump) that is typically installed via Git or manual file download. The supply chain risk is limited to the extension's codebase and its integration into a MediaWiki farm.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication is needed to trigger the impersonation.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Private import requests can be viewed.
• Integrity Impact: Low (I:L) – Comments and request details can be modified.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires a specific condition (same actor ID across wikis) which may be rare in typical deployments, but in large MediaWiki farms with many wikis, the risk increases.

Deep Dive & Mechanics

The ImportDump extension uses a local actor ID to identify users who submit import requests. In a MediaWiki farm (multiple wikis sharing a central user database), each wiki has its own actor ID mapping. The vulnerability arises because the extension does not verify that the actor ID from a remote wiki corresponds to the same user on the central wiki. If an attacker on a remote wiki has an actor ID that matches a legitimate user on the central wiki, they can impersonate that user.

Root Cause: The extension stores the actor ID directly from the local wiki without cross-referencing it with the central user identity. This is a classic improper authentication (CWE-287) issue.

Attack Scenario:

1. An attacker registers on a remote wiki within the same MediaWiki farm.
2. The attacker's local actor ID happens to be the same as a target user on the central wiki (e.g., both have actor ID 123).
3. The attacker uses the ImportDump special page on the remote wiki to create or modify import requests, which are stored with the actor ID 123.
4. The central wiki treats these requests as if they were made by the legitimate user, allowing the attacker to view private requests, add comments, or edit request details.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 5c91dfc): The extension likely used the local actor ID directly without validation. For example:

// Vulnerable: stores local actor ID without cross-wiki check
$actorId = $this->getUser()->getActorId();
$request->setActorId($actorId);

Patched Code (after commit 5c91dfc): The patch adds a cross-wiki identity check, ensuring that the actor ID is mapped to the correct global user. For example:

// Patched: verify actor ID against central user
$globalUserId = $this->getCentralIdManager()->getCentralIdFromLocalUser($this->getUser());
$actorId = $this->getUser()->getActorId();
if ($this->getCentralIdManager()->getLocalUserFromCentralId($globalUserId)->getActorId() !== $actorId) {
    throw new SecurityException('Actor ID mismatch');
}
$request->setActorId($actorId);

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a remote wiki within the same MediaWiki farm as the target central wiki.
• Knowledge of a target user's actor ID on the central wiki (can be guessed or enumerated if actor IDs are sequential).

Exploitation Steps:

1. Identify a target user on the central wiki (e.g., an admin with actor ID 100).
2. On the remote wiki, register a new user or use an existing one. Check the local actor ID (e.g., via API or database query).
3. If the local actor ID matches the target (e.g., also 100), proceed. Otherwise, repeat registration until a match is found (brute-force actor IDs if possible).
4. Access the ImportDump special page on the remote wiki (e.g., Special:ImportDump).
5. Create a new import request or edit an existing one. The request will be attributed to the target user on the central wiki.
6. If the request is private, the attacker can now view it and any associated comments.

Lab Setup:

• Deploy a MediaWiki farm with at least two wikis (e.g., using MediaWiki Docker images).
• Install the vulnerable version of ImportDump extension (before commit 5c91dfc).
• Create a user on the central wiki and note their actor ID.
• On the remote wiki, create users until one gets the same actor ID.
• Test the impersonation by creating a request on the remote wiki and verifying it appears as the central user on the central wiki.

Blue Team

Detection:

• Monitor for unusual import request activity from remote wikis, especially if the requester's actor ID matches a high-privilege user on the central wiki.
• Log all ImportDump actions with the source wiki and actor ID. Correlate with central user identity.
• Implement alerts for multiple failed login attempts on remote wikis (possible actor ID brute-force).

Hunting:

• Query the ImportDump database table for requests where the actor ID does not match the central user's actor ID (requires cross-wiki database access).
• Review audit logs for requests made by users who are not active on the central wiki.

Indicators of Compromise (IOCs)

• Actor ID mismatches: ImportDump requests where the actor ID on the remote wiki does not correspond to the same user on the central wiki.
• Unusual request patterns: A sudden increase in import requests from a remote wiki, especially from a user with a low registration date.
• Private request access: Access logs showing a user viewing a private import request that they should not have permission to see.
• Database anomalies: In the importdump_requests table, entries where request_actor does not match the expected global user ID.

Detection Engineering

YARA Rule

rule Detect_ImportDump_ActorID_Mismatch {
    meta:
        description = "Detects potential actor ID impersonation in ImportDump extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-47816"
    strings:
        $actor_id = /actor_id\s*=\s*\d+/ nocase
        $request_actor = /request_actor\s*=\s*\d+/ nocase
    condition:
        any of them
}

Sigma Rule

title: ImportDump Actor ID Impersonation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential actor ID impersonation in ImportDump extension (CVE-2024-47816)
author: Valters IT
date: 2025-04-10
logsource:
    product: mediawiki
    service: importdump
detection:
    selection:
        EventID: 'ImportDumpRequestCreated'
        ActorID|re: '^\d+$'
    condition: selection
falsepositives:
    - Legitimate cross-wiki requests with matching actor IDs (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47816 ImportDump Actor ID Impersonation"; flow:to_server; content:"Special:ImportDump"; http_uri; content:"action=submit"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the ImportDump extension to the latest commit (5c91dfc or later).
2. If unable to update, disable the Special:ImportDump page on all non-global wikis. This can be done by modifying the MediaWiki configuration (see miraheze/mw-config@e566499).

Long-term Fixes:

• Implement cross-wiki user identity verification in all extensions that use actor IDs.
• Use global user IDs instead of local actor IDs for cross-wiki operations.
• Regularly audit actor ID mappings across the wiki farm.

Workaround:

• Restrict access to the ImportDump special page to trusted users only.
• Monitor actor ID collisions and alert on suspicious activity.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.