CVE-2021-21275 (published 2021-01-25T23:15Z)

The MediaWiki "Report" extension has a Cross-Site Request Forgery (CSRF) vulnerability. Before fixed version, there was no protection against CSRF checks on Special:Report, so requests to report a revision could be forged. The problem has been fixed in commit f828dc6 by making use of MediaWiki edit tokens.

Severity: MEDIUM
CVSS v2 base score: 4.3 (AV:N/AC:M/Au:N/C:N/I:P/A:N)
CVSS v3 base score: 4.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/Kenny2github/Report
commit_details: repo_url: https://github.com/Kenny2github/Report
author: Kenny2github
author_date: 2021-01-21 19:24:06+00:00
msg: Add CSRF check for Special:Report

Also clean up a little of the logic
repository: repo_url: https://github.com/Kenny2github/Report
repo_name: Kenny2github/Report
description: A MediaWiki extension to report revisions.
repo_language: PHP
owner: Kenny2github
file_changes: filename: SpecialReport.php
change_type: ModificationType.MODIFY
diff: @@ -55,7 +55,7 @@ class SpecialReport extends SpecialPage {
 		}
 		$request = $this->getRequest();
 		if ($request->wasPosted()) {
-			return self::onPost( $par, $out, $request );
+			return self::onPost( $par, $out, $request, $user );
 		}
 		$out->setIndexPolicy( 'noindex' );
 		$out->addHTML(
@@ -87,6 +87,14 @@ class SpecialReport extends SpecialPage {
 				'id' => 'mw-report-form-reason'
 			]
 		));
+		$out->addHTML(Html::rawElement(
+			'input',
+			[
+				'type' => 'hidden',
+				'name' => 'token',
+				'value' => $user->getEditToken()
+			]
+		));
 		$out->addHTML(Html::rawElement(
 			'input',
 			[
@@ -98,29 +106,31 @@ class SpecialReport extends SpecialPage {
 		$out->addHTML(Html::closeElement( 'form' ));
 	}
 
-	static public function onPost( $par, $out, $request ) {
-		global $wgUser;
+	static public function onPost( $par, $out, $request, $user ) {
+		if (!$user->matchEditToken($request->getText( 'token' ))) {
+			$out->addWikiMsg( 'sessionfailure' );
+			return;
+		}
 		if (!$request->getText('reason')) {
 			$out->addHTML(Html::rawElement(
 				'p',
 				[ 'class' => 'error '],
 				wfMessage( 'report-error-missing-reason' )->escaped()
 			));
-		} else {
-			$dbw = wfGetDB( DB_MASTER );
-			$dbw->startAtomic(__METHOD__);
-			$dbw->insert( 'report_reports', [
-				'report_revid' => (int)$par,
-				'report_reason' => $request->getText('reason'),
-				'report_user' => $wgUser->getId(),
-				'report_user_text' => $wgUser->getName(),
-				'report_timestamp' => wfTimestampNow()
-			], __METHOD__ );
-			$dbw->endAtomic(__METHOD__);
-			$out->addWikiMsg( 'report-success' );
-			$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );
 			return;
 		}
+		$dbw = wfGetDB( DB_MASTER );
+		$dbw->startAtomic(__METHOD__);
+		$dbw->insert( 'report_reports', [
+			'report_revid' => (int)$par,
+			'report_reason' => $request->getText('reason'),
+			'report_user' => $user->getId(),
+			'report_user_text' => $user->getName(),
+			'report_timestamp' => wfTimestampNow()
+		], __METHOD__ );
+		$dbw->endAtomic(__METHOD__);
+		$out->addWikiMsg( 'report-success' );
+		$out->addWikiMsg( 'returnto', '[[' . SpecialPage::getTitleFor('Diff', $par)->getPrefixedText() . ']]' );
 	}
 
 	public function getGroupName() {

programming_language: PHP