CVE-2014-3455 in MediaWiki
Summary
by MITRE
Multiple cross-site request forgery (CSRF) vulnerabilities in the (1) CreateProperty, (2) CreateTemplate, (3) CreateForm, and (4) CreateClass special pages in the SemanticForms extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allow remote attackers to hijack the authentication of users for requests that have unspecified impact and vectors.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 03/09/2019
The CVE-2014-3455 vulnerability represents a critical cross-site request forgery weakness discovered in the SemanticForms extension for MediaWiki, affecting multiple versions prior to the mentioned security patches. This vulnerability specifically targets four key special pages within the extension including CreateProperty, CreateTemplate, CreateForm, and CreateClass, which are fundamental components for creating structured content within MediaWiki environments. The flaw allows remote attackers to exploit the authentication mechanisms of legitimate users, potentially enabling unauthorized actions within the wiki system without the user's knowledge or consent.
The technical implementation of this CSRF vulnerability stems from the absence of proper anti-CSRF protection mechanisms within the affected special pages of the SemanticForms extension. When users navigate to these specific pages and subsequently make requests to create properties, templates, forms, or classes, the system fails to validate the authenticity of the request origin. This validation gap enables attackers to craft malicious requests that appear to originate from legitimate authenticated users, exploiting the trust relationship between the user's browser and the MediaWiki application. The vulnerability is particularly concerning because it operates at the core functionality level of content creation within MediaWiki, where the impact of successful exploitation can range from unauthorized content modification to complete system compromise depending on the attacker's objectives and the wiki's configuration.
From an operational impact perspective, this vulnerability creates significant security risks for organizations relying on MediaWiki with SemanticForms extension for collaborative content management. Attackers could leverage these CSRF vulnerabilities to inject malicious data into wikis, modify existing templates and forms, or potentially escalate privileges within the system. The unspecified impact and vectors mentioned in the CVE description indicate that the consequences could vary widely based on the specific wiki configuration, user permissions, and the attacker's sophistication level. The vulnerability affects multiple version streams of MediaWiki, including the 1.19.x, 1.20.x, and 1.22.x branches, suggesting a widespread exposure across various deployment environments. This broad impact makes the vulnerability particularly dangerous as it affects not just individual installations but represents a systemic risk across the MediaWiki ecosystem.
Organizations should implement immediate mitigations including upgrading to the patched versions mentioned in the CVE advisory, specifically MediaWiki 1.19.10, 1.21.4, and 1.22.1. Additional protective measures include implementing proper CSRF token validation mechanisms, enabling secure session management, and conducting thorough security reviews of all extension installations. The vulnerability aligns with CWE-352, which specifically addresses Cross-Site Request Forgery, and represents a clear violation of the principle of least privilege and proper authentication verification. From an ATT&CK framework perspective, this vulnerability maps to techniques involving privilege escalation and persistent threats, as attackers could establish footholds within wiki environments to conduct prolonged malicious activities. Organizations should also consider implementing network-level protections and monitoring for suspicious requests originating from authenticated sessions, as the vulnerability specifically targets the authentication hijacking aspect of user sessions.