CVE-2011-4360 in MediaWiki
Summary
by MITRE
MediaWiki before 1.17.1 allows remote attackers to obtain the page titles of all restricted pages via a series of requests involving the (1) curid or (2) oldid parameter.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/28/2021
MediaWiki versions prior to 1.17.1 contain a critical information disclosure vulnerability that enables remote attackers to access page titles of restricted content through carefully crafted HTTP requests. This vulnerability specifically affects the API handling mechanism when processing curid or oldid parameters, which are used to reference specific page versions or current page identifiers within the MediaWiki system. The flaw exists in the permission checking logic that fails to properly validate user access rights when these parameters are utilized in API requests, allowing unauthorized users to enumerate titles of pages they should not be able to view.
The technical exploitation of this vulnerability occurs through a multi-step request process that leverages the MediaWiki API's response handling for page identification parameters. When attackers submit requests containing curid or oldid parameters, the system processes these identifiers without adequate authorization verification, potentially returning page titles that correspond to restricted content. This information disclosure vulnerability operates at the application layer and can be exploited without requiring authentication, making it particularly dangerous for wikis that host sensitive or confidential information. The flaw directly relates to CWE-200, which encompasses information exposure vulnerabilities, and represents a failure in access control mechanisms that should prevent unauthorized information retrieval.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables attackers to map the structure and content hierarchy of restricted wikis. This reconnaissance capability allows adversaries to identify sensitive pages, understand content organization, and potentially plan more sophisticated attacks targeting specific restricted areas. The vulnerability affects wikis that rely on user permissions and access control lists, making it particularly concerning for corporate, governmental, or institutional wikis where information classification is critical. Attackers can systematically enumerate titles across multiple requests, building a comprehensive inventory of restricted content that may include confidential documents, internal communications, or protected research data.
Organizations using vulnerable MediaWiki versions should immediately implement the patch released with MediaWiki 1.17.1, which addresses the access control validation issue by strengthening the permission checking mechanisms for curid and oldid parameters. Additional mitigations include implementing proper API rate limiting to prevent automated enumeration attempts, configuring web application firewalls to monitor and block suspicious request patterns, and conducting regular security audits of API endpoints to ensure proper access controls remain in place. This vulnerability aligns with ATT&CK technique T1213.002, which covers data from information repositories, and demonstrates how insufficient access control validation can lead to unauthorized information discovery. Organizations should also consider implementing comprehensive logging and monitoring of API access patterns to detect potential exploitation attempts and maintain audit trails for security incident response activities.