^{CVE-2021-31552:}Improper Authorization in MediaWiki AbuseFilter Extension Allows Account Creation While Only Blocking IP Addresses

Overview

The AbuseFilter extension for MediaWiki is designed to help administrators combat vandalism and enforce policies by automatically detecting and responding to problematic edits and account creations. This vulnerability (CVE-2021-31552) stems from improper authorization controls (CWE-863) in the extension's rule execution logic. When certain rules are configured to block accounts after creation, the system incorrectly applies blocks only to the IP addresses used during account creation, leaving the newly created accounts unblocked and operational. This undermines the intended security controls and allows potentially malicious accounts to remain active. Furthermore, the vulnerability enables unprivileged users to potentially enumerate and collect IP addresses associated with account creations, creating privacy concerns and providing information that could be used in further attacks.

Remediation

To address this vulnerability, MediaWiki administrators should:

1. Update the AbuseFilter extension to the latest version that contains the security fix.
2. Review and adjust any AbuseFilter rules that target account creation to ensure they function as intended.
3. Audit existing user accounts that may have been created while evading proper blocking mechanisms.
4. Consider implementing additional monitoring for suspicious account creation patterns.
5. Apply the patch referenced in the Wikimedia Gerrit repository (I8bae477ad7e4d0190335363ac2decf28e4313da1) if unable to update to a fixed version.

References

1. Wikimedia Gerrit Repository Patch: https://gerrit.wikimedia.org/r/q/I8bae477ad7e4d0190335363ac2decf28e4313da1
2. Wikimedia Phabricator Issue Tracking: https://phabricator.wikimedia.org/T152394
3. Common Weakness Enumeration: CWE-863 (Incorrect Authorization)
4. MediaWiki AbuseFilter Extension Documentation: https://www.mediawiki.org/wiki/Extension:AbuseFilter