CVE-2021-32774 (published 2021-07-20T01:15Z)

DataDump is a MediaWiki extension that provides dumps of wikis. Prior to commit 67a82b76e186925330b89ace9c5fd893a300830b, DataDump had no protection against CSRF attacks so requests to generate or delete dumps could be forged. The vulnerability was patched in commit 67a82b76e186925330b89ace9c5fd893a300830b. There are no known workarounds. You must completely disable DataDump.

Severity: MEDIUM
CVSS v2 base score: 5.8 (AV:N/AC:M/Au:N/C:N/I:P/A:P)
CVSS v3 base score: 5.4, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/miraheze/DataDump
commit_details: repo_url: https://github.com/miraheze/DataDump
author: RhinosF1
author_date: 2021-07-08 02:40:02+01:00
msg: Merge pull request from GHSA-29mh-4vhv-x8mr

* Add CSRF token check for generating dumps

* Update SpecialDataDump.php

* Add token for action=download

* Fix indendation

* Fix indendation

* fix indentation

* Convert to forms

* fix link generation

* don't check on download pt1

* don't check on download pt2

* rm stray code

* rm accidentally added character

* rm stray whitespace

* rm unused variable

* standardize

Co-authored-by: R4356th <61620631+R4356th@users.noreply.github.com>
Co-authored-by: The-Voidwalker <voidwalker.wikipedia@gmail.com>
Co-authored-by: R4356th <radman.siddiki@gmail.com>
repository: repo_url: https://github.com/miraheze/DataDump
repo_name: miraheze/DataDump
description: An extension that provides dumps of wikis
repo_language: PHP
owner: miraheze
file_changes: filename: DataDumpPager.php
change_type: ModificationType.MODIFY
diff: @@ -75,15 +75,35 @@ class DataDumpPager extends TablePager {
 					$this->getLanguage()->formatSize( isset( $row->dumps_size ) ? $row->dumps_size : 0 ) );
 				break;
 			case 'dumps_delete':
-				$linkRenderer = MediaWikiServices::getInstance()->getLinkRenderer();
-
 				$query = [
 					'action' => 'delete',
 					'type' => $row->dumps_type,
 					'dump' => $row->dumps_filename
 				];
-
-				$formatted = $linkRenderer->makeLink( $this->pageTitle, wfMessage( 'datadump-delete-button' )->text(), [], $query );
+				$link = $this->pageTitle->getLinkURL( $query );
+				$element = Html::element(
+					'input', 
+					[
+						'type' => 'submit',
+						'title' => $this->pageTitle,
+						'value' => wfMessage('datadump-delete-button')->text()
+					]
+				);
+				$token = Html::element(
+					'input',
+					[
+						'type' => 'hidden',
+						'name' => 'token',
+						'value' => $this->getUser()->getEditToken()
+					]
+				);
+				$formatted = Html::openElement(
+					'form',
+					[
+						'action' => $link,
+						'method' => 'POST'
+					]
+				) . $element . $token . Html::closeElement('form');
 				break;
 			default:
 				$formatted = "Unable to format $name";
@@ -204,6 +224,8 @@ class DataDumpPager extends TablePager {
 			$perm = $dataDumpConfig[$type]['permissions']['generate'];
 			if ( !$this->permissionManager->userHasRight( $user, $perm) ) {
 				throw new PermissionsError( $perm );
+			} elseif ( !$user->matchEditToken( $this->getContext()->getRequest()->getText( 'wpEditToken' ) ) ) {
+				return;
 			}
 
 			if ( $this->getGenerateLimit( $type ) ) {

programming_language: PHP
filename: SpecialDataDump.php
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,8 @@ class SpecialDataDump extends SpecialPage {
 		$out = $this->getOutput();
 	
 		$request = $this->getRequest();
+		
+		$user = $this->getUser();
 
 		$dataDumpConfig = $this->config->get( 'DataDump' );
 		if ( !$dataDumpConfig ) {
@@ -52,7 +54,11 @@ class SpecialDataDump extends SpecialPage {
 			if ( $action === 'download' && $dump ) {
 				$this->doDownload( $dump );
 			} elseif ( $action === 'delete' && $type && $dump ) {
-				$this->doDelete( $type, $dump );
+				if ( $user->matchEditToken($request->getVal('token'))) {
+					$this->doDelete( $type, $dump );
+				} else { 
+					$out->addWikiMsg( 'sessionfailure' );
+				}
 			}
 		}
 

programming_language: PHP