BotPasswords can bypass CentralAuth's account lock

Vulnerability

MediaWiki versions 1.31 before 1.31.1, 1.30.1, 1.29.3, and 1.27.5 contain a flaw in the BotPasswords feature that allows it to bypass CentralAuth's account lock [1][2]. The vulnerability exists when CentralAuth is used to lock an account; normally, the lock prevents all actions, but BotPasswords can still be used to perform actions on behalf of that account.

Exploitation

An attacker who possesses a valid bot password for a locked account can use that password to execute actions as if the account were not locked [1]. The attacker must already have a bot password registered for the target account. No additional privileges or user interaction is required beyond possession of the bot password.

Impact

Successful exploitation allows an attacker to bypass the account lock enforced by CentralAuth, effectively performing actions (such as edits, API calls, etc.) on behalf of a locked account [2]. This undermines the security measure of account locking, potentially leading to unauthorized changes or information disclosure.

Mitigation

Upgrade to fixed versions: MediaWiki 1.31.1, 1.30.1, 1.29.3, or 1.27.5 [2]. Note that MediaWiki 1.29 reached end-of-life in July 2018, so upgrading to a supported branch (1.31 or later) is recommended [2]. Updates are also available via Red Hat OpenShift Container Platform advisories RHSA-2019:3142 and RHSA-2019:3238 for affected deployments [3][4].