Listen to this Post
Semantic MediaWiki’s Special:URIResolver takes a user-supplied subpage parameter and resolves it into a MediaWiki object. The special page then issues an HTTP 303 redirect to the full URL of that resolved without ever checking where the final URL actually points. The problem is that the subpage can be crafted to resolve to an interwiki . When a user visits a URL like Special:URIResolver/mw-3AFoo, the `mw-3A` segment decodes to the interwiki prefix mw:, and the page resolves that to the foreign wiki https://www.mediawiki.org/wiki/Foo`. Because the redirect sink blindly trusts$->getFullURL()`, the browser is sent off-host. The resolved URL can even embed `user:pass@host` authority syntax, making the phishing link look like it belongs to the trusted wiki while actually pointing somewhere else entirely. The vulnerability is network-accessible, requires no privileges, and only needs a victim to follow a crafted link. Version 7.2.0 fixes the issue by parsing the resolved target URL and comparing its host against the current host at the redirect sink, and by rejecting redirects that contain user or pass components or that point off-host. The maintenance lesson is that redirect code must validate the final target URL, not just the input path, and host comparison belongs at each redirect sink rather than relying on upstream normalization.
DailyCVE Form:
Platform: Semantic MediaWiki
Version: < 7.2.0
Vulnerability: Open redirect
Severity: Moderate
date: Sep 18, 2026
Prediction: July 17, 2026
What Undercode Say:
Analytics
Detect affected Semantic MediaWiki version grep -r "SemanticMediaWiki" /var/www/html/extensions/ | grep -i "version" Test for open redirect via curl (replace TARGET with your wiki host) curl -sI "https://TARGET/wiki/Special:URIResolver/mw-3AFoo" | grep -i "location" Expected vulnerable response: Location: https://www.mediawiki.org/wiki/Foo Test credential-embedding variant curl -sI "https://TARGET/wiki/Special:URIResolver/mw-3Auser%3Apass%40evil.com" | grep -i "location"
// Vulnerable code pattern in SpecialURIResolver.php (prior to 7.2.0)
$subpage = $this->getRequest()->getVal( 'subpage' );
$ = :newFromText( $subpage );
if ( $ !== null ) {
$url = $->getFullURL(); // resolves interwiki, no host check
$this->getOutput()->redirect( $url, 303 ); // blind 303 redirect
}
Exploit: (Educational Purposes!)
Craft phishing URL that appears to originate from trusted wiki https://trusted-wiki.example/wiki/Special:URIResolver/mw-3APhishingPage Decodes to mw:PhishingPage → redirects to https://www.mediawiki.org/wiki/PhishingPage Attacker can point interwiki prefix to their own wiki and host a credential-harvesting page Credential-embedding variant makes the link look even more legitimate: https://trusted-wiki.example/wiki/Special:URIResolver/mw-3Auser%3Apass%40evil.example
Protection: from this CVE
- Upgrade Semantic MediaWiki to 7.2.0 or later via Composer: `composer update mediawiki/semantic-media-wiki`
– If immediate upgrade is not possible, modify each redirect sink to validate the final resolved target URL’s host and reject off-host redirects - Reject redirects when a `user` or `pass` component is present in the resolved URL
- Ensure host comparison happens at the redirect sink itself, not relying on upstream normalization
Impact:
An attacker can use a trusted wiki URL to redirect victims to an attacker-controlled host, enabling convincing phishing attacks. Because the initial link points to the legitimate wiki domain, users are more likely to trust it. The ability to embed `user:pass@host` credentials in the resolved URL further increases the believability of the phishing link. The vulnerability requires no authentication and is network-accessible, making it a low-barrier vector for social engineering campaigns.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
