CVE-2020-15005: MediaWiki Core Image Authorization Cache Leak Vulnerability
Summary
CVE-2020-15005: img_auth.php may leak private extension images into the public cache. Affects mediawiki/core across 3 version ranges.
< 1.31.8
>= 1.32.0, < 1.33.4
>= 1.34.0, < 1.34.2
Fixed in 1.31.8, 1.33.4 or 1.34.2, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-15005 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a widely used open-source wiki software platform that allows users to create and manage collaborative content. It features a robust set of tools for editing, formatting, and organizing information, making it popular for projects like Wikipedia. The software includes an image authorization feature (img_auth.php) that is designed to restrict access to private images. However, certain configurations can lead to vulnerabilities that expose these private images to unauthorized users.
Vulnerability Detail
In MediaWiki versions prior to 1.31.8, 1.32.x, and 1.33.x before 1.33.4, as well as 1.34.x before 1.34.2, a vulnerability exists where private images could be cached publicly by a caching server. This issue arises from improper handling of Cache-Control and Vary headers, allowing unauthorized users to access private images that should have been protected. The ramifications of this vulnerability include potential exposure of sensitive content, leading to privacy breaches and unauthorized information dissemination.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.31.81.31.8composer require mediawiki/core:1.31.8 -
>= 1.32.0, < 1.33.41.33.4composer require mediawiki/core:1.33.4 -
>= 1.34.0, < 1.34.21.34.2composer require mediawiki/core:1.34.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable caching for the img_auth.php script by configuring their caching server to bypass caching for this specific endpoint. This can be done by adding the following rule to the server configuration:
location /img_auth.php {
proxy_no_cache 1;
proxy_cache_bypass 1;
}
Conclusion
The CVE-2020-15005 vulnerability in MediaWiki poses a significant risk by allowing unauthorized access to private images due to improper caching. It is crucial for users to update their installations to the latest patched versions to protect sensitive content. Additionally, implementing temporary workarounds can help mitigate risks until updates are applied.
See every vulnerability recorded for mediawiki/core →
FAQ
CVE-2020-15005 is a vulnerability in MediaWiki that allows unauthorized access to private images due to improper caching configurations.
If you are using MediaWiki versions prior to 1.31.8, 1.33.4, or 1.34.2, your installation may be vulnerable. You can check your version in the MediaWiki footer or by accessing the Special:Version page.
The vulnerability can lead to unauthorized users accessing private images, which may result in privacy violations and exposure of sensitive information.
You can update MediaWiki using Composer. Run the command 'composer require mediawiki/core:^1.34.2' to install the latest secure version.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software using just the composer.lock file. You can check your application for vulnerabilities without any signup at the Vulert playground.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
