CVE-2013-4572 in MediaWiki
Summary
by MITRE
The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies when a user is autocreated, which allows remote attackers to authenticate as the created user.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 06/02/2021
The vulnerability described in CVE-2013-4572 affects the CentralNotice extension within MediaWiki platforms, specifically targeting versions prior to 1.19.9, 1.20.8, and 1.21.3. This issue represents a critical security flaw in session management and cookie handling mechanisms that directly impacts user authentication integrity. The vulnerability stems from improper configuration of HTTP cache control headers during the user autocreation process, creating a persistent security risk for organizations relying on MediaWiki for content management and user interaction.
The technical flaw manifests when the CentralNotice extension handles user autocreation, where it incorrectly sets the Cache-Control header to allow caching of session cookies. This configuration error enables attackers to exploit the cached session data and authenticate as the autocreated user account. The vulnerability operates at the HTTP protocol level through improper header management, specifically the Cache-Control directive that should prevent caching of sensitive session information. This flaw aligns with CWE-524, which addresses information exposure through cache mechanisms, and represents a classic example of insecure session management practices.
The operational impact of this vulnerability is severe as it allows remote attackers to gain unauthorized access to user accounts without requiring valid credentials or authentication tokens. An attacker can leverage the cached session cookies to impersonate the autocreated user indefinitely, potentially accessing restricted content, modifying user preferences, or performing actions within the application that should be limited to authorized users. This authentication bypass affects not only individual user accounts but also the overall security posture of MediaWiki installations, particularly those with active user autocreation features and centralized notice systems.
Organizations should immediately implement mitigations including upgrading to patched versions of MediaWiki that address this vulnerability, specifically versions 1.19.9, 1.20.8, and 1.21.3 or later. Additionally, administrators should review and harden their HTTP header configurations to ensure that session cookies are properly marked with appropriate cache control directives such as 'no-cache' or 'no-store'. The mitigation strategy should also include monitoring for unauthorized user account creation and implementing additional authentication layers including multi-factor authentication where possible. This vulnerability demonstrates the importance of proper HTTP header management and aligns with ATT&CK technique T1548.003, which covers abuse of credentials through session management flaws, emphasizing the need for comprehensive security controls around authentication mechanisms.