CVE-2021-30153 : Security Advisory and Response

An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. When using VisualEditor to edit a MediaWiki user page belonging to an existing, but hidden, user, VisualEditor will disclose that the user exists. This is related to ApiVisualEditor.

Understanding CVE-2021-30153

This CVE identifies a vulnerability in VisualEditor extension in certain versions of MediaWiki that leads to the disclosure of hidden user existence.

What is CVE-2021-30153?

CVE-2021-30153 is a security loophole in VisualEditor extension prior to version 1.31.13 and versions 1.32.x through 1.35.x before 1.35.2 in MediaWiki. It allows the exposure of hidden user details when editing user pages using VisualEditor.

The Impact of CVE-2021-30153

The impact of this CVE is that it can expose the existence of hidden users, compromising their privacy and security. This information disclosure can be exploited by malicious actors.

Technical Details of CVE-2021-30153

The technical details of this CVE include:

Vulnerability Description

The vulnerability in VisualEditor extension allows the disclosure of hidden user existence when editing user pages in affected versions of MediaWiki.

Affected Systems and Versions

All versions of MediaWiki before 1.31.13, and versions from 1.32.x to 1.35.x before 1.35.2 are affected by this security flaw.

Exploitation Mechanism

The vulnerability can be exploited by using VisualEditor to edit user pages of hidden users, thereby exposing their existence.

Mitigation and Prevention

To mitigate the risks associated with CVE-2021-30153, the following steps can be taken:

Immediate Steps to Take

Upgrade MediaWiki to version 1.31.13, 1.35.2, or later where the vulnerability is patched.
Avoid using VisualEditor to edit user pages of hidden users until the system is updated.

Long-Term Security Practices

Regularly update MediaWiki and its extensions to the latest versions to ensure security patches are applied promptly.
Educate users about privacy settings and the risks of data exposure.

Patching and Updates

Install patches provided by MediaWiki for the affected versions to eliminate the vulnerability and protect user privacy.