CVE-2025-32964

Executive Summary

CVE-2025-32964 is a missing authorization vulnerability in the ManageWiki extension for MediaWiki. The flaw allows a user with basic permissions to inadvertently disable a restricted extension by enabling a conflicting extension. This bypasses the intended authorization check that should require the ManageWiki-restricted right. The vulnerability has a CVSS score of 4.6 (Medium) and is patched in commit 00bebea. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability affects the ManageWiki extension, which is a third-party MediaWiki extension. The risk is primarily to MediaWiki administrators who rely on this extension to manage wiki configurations. The supply chain risk is moderate, as the extension is not part of the core MediaWiki package but is widely used in wiki farms.

CVSS Breakdown & Threat Level

• CVSS Score: 4.6 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (user must have basic ManageWiki permissions)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low (unauthorized disabling of restricted extensions)
• Availability Impact: None

Threat Level: Medium. The vulnerability allows a low-privileged user to disable restricted extensions, potentially disrupting wiki functionality or security controls.

Deep Dive & Mechanics

The ManageWiki extension allows users with appropriate permissions to enable and disable extensions on a per-wiki basis. The vulnerability lies in the logic that handles extension conflicts. When a user enables an extension that conflicts with another, the system automatically disables the conflicting extension. However, the authorization check for disabling the conflicting extension was missing. This means a user who does not hold the ManageWiki-restricted right could still disable a restricted extension by enabling a conflicting one.

The core issue is in the conflict resolution code. The system should verify that the user has the ManageWiki-restricted right before disabling a restricted extension. The patched code adds this check.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In the conflict resolution function
function resolveConflicts($extensionToEnable) {
    $conflicts = getConflicts($extensionToEnable);
    foreach ($conflicts as $conflict) {
        // Missing authorization check
        disableExtension($conflict);
    }
    enableExtension($extensionToEnable);
}

Patched Code (Conceptual):

function resolveConflicts($extensionToEnable) {
    $conflicts = getConflicts($extensionToEnable);
    foreach ($conflicts as $conflict) {
        // Added authorization check
        if (isRestricted($conflict) && !userHasRight('ManageWiki-restricted')) {
            throw new PermissionException('You do not have permission to disable this restricted extension.');
        }
        disableExtension($conflict);
    }
    enableExtension($extensionToEnable);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a MediaWiki instance with ManageWiki extension installed (pre-commit 00bebea).
• A user account with basic ManageWiki permissions (e.g., managewiki right) but NOT the ManageWiki-restricted right.

Exploitation Steps:

1. Identify a restricted extension (e.g., RestrictedExtension) that conflicts with a non-restricted extension (e.g., NormalExtension).
2. As the low-privileged user, navigate to the ManageWiki interface.
3. Attempt to enable NormalExtension.
4. The system will automatically disable RestrictedExtension due to the conflict, bypassing the authorization check.

Expected Outcome: The restricted extension is disabled, even though the user lacks the required permission.

Blue Team

Detection:

• Monitor ManageWiki logs for unexpected disabling of restricted extensions.
• Alert on any user without the ManageWiki-restricted right performing actions that disable restricted extensions.

Hunting:

• Search for log entries where a restricted extension was disabled by a user who does not have the ManageWiki-restricted right.
• Review recent changes to extension configurations in the wiki.

Mitigation:

• Apply the patch (commit 00bebea) immediately.
• As a workaround, ensure that any extensions requiring specific permissions in $wgManageWikiExtensions also require the same permissions for managing any conflicting extensions.

Indicators of Compromise (IOCs)

• Log Entries: Unexpected disabling of restricted extensions in ManageWiki logs.
• User Actions: Users with only basic ManageWiki permissions disabling restricted extensions.
• Configuration Changes: Sudden changes to the enabled extensions list, particularly disabling of restricted extensions.

Detection Engineering

YARA Rule

rule CVE_2025_32964_ManageWiki_AuthBypass {
    meta:
        description = "Detects vulnerable ManageWiki extension code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32964"
    strings:
        $vuln_func = "resolveConflicts" nocase
        $missing_check = "disableExtension" nocase
    condition:
        $vuln_func and $missing_check and not for any of ($patch_check*)
}

Sigma Rule

title: ManageWiki Restricted Extension Disabled by Unauthorized User
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects when a restricted extension is disabled by a user without the ManageWiki-restricted right
logsource:
    product: mediawiki
    service: managewiki
detection:
    selection:
        EventID: 'managewiki-extension-disabled'
        ExtensionType: 'restricted'
        UserRight: '!ManageWiki-restricted'
    condition: selection
falsepositives:
    - Legitimate administrative actions if logging is misconfigured
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32964 ManageWiki Restricted Extension Disable Attempt"; flow:to_server; content:"POST"; http_method; content:"/wiki/Special:ManageWiki"; http_uri; content:"extension="; http_uri; content:"action=enable"; http_uri; pcre:"/extension=[^&]+&action=enable/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Apply the patch from commit 00bebea to the ManageWiki extension.
• Verify that the patch is applied correctly by testing the conflict resolution with a restricted extension.

Workaround:

• Ensure that any extensions requiring specific permissions in $wgManageWikiExtensions also require the same permissions for managing any conflicting extensions.

Long-term:

• Review all authorization checks in the ManageWiki extension to ensure they are consistent.
• Implement regular security audits of MediaWiki extensions.
• Monitor for any similar authorization bypass vulnerabilities.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.