Information disclosure in Special:Redirect/logid

Vulnerability

MediaWiki versions 1.31.x before 1.31.1, 1.30.x before 1.30.1, 1.29.x before 1.29.3, and 1.27.x before 1.27.5 contain an information disclosure flaw in the Special:Redirect/logid handler. When a log event is partially hidden (e.g., username or IP address suppressed), the redirect may point to a different log entry that still reveals the hidden details [1][2].

Exploitation

An attacker can craft a URL such as Special:Redirect/logid/ that references a log event that has been partially hidden. The redirect may then display a log entry that includes the suppressed information, allowing the attacker to view it directly. No special authentication or privileges are required beyond the ability to access the wiki [2].

Impact

Successful exploitation leads to unauthorized disclosure of hidden log event details, such as suppressed usernames or IP addresses. This is a confidentiality breach that does not grant code execution or privilege escalation [2].

Mitigation

Fixed versions are MediaWiki 1.27.5, 1.29.3, 1.30.1, and 1.31.1, released in September 2018 [3]. Users are strongly advised to upgrade to these or later versions. Note that MediaWiki 1.29 reached end-of-life in July 2018, so upgrading to 1.31.x is recommended [3]. The fix is also included in the Red Hat advisory for OpenShift Container Platform 3.10 [4]. No workarounds have been documented.