CVE-2019-16738

Root

Cause The vulnerability lies in the Special:Redirect page, specifically the /user/NNN path. When a user ID is provided, the code redirects to the corresponding user page without checking whether the user account has been suppressed (hidden) [1]. This oversight allows any user, including unauthenticated ones, to discover the username associated with a suppressed user ID.

Exploitation

An attacker can exploit this by enumerating user IDs through Special:Redirect or by directly linking to [[Special:Redirect/user/SUPPRESSED_USER_ID]] [1]. The attacker does not need any special privileges; they only need to guess or iterate through user IDs. The redirect will succeed, revealing the suppressed username.

Impact

Successful exploitation leads to information disclosure of suppressed usernames. Suppressed accounts are typically hidden for privacy or legal reasons, and their exposure undermines the intended confidentiality [2]. This can be used to identify users who have been hidden, potentially leading to further targeted attacks.

Mitigation

The issue was fixed in MediaWiki by adding a check for the user's suppressed status before performing the redirect [1]. Users should upgrade to a patched version (e.g., 1.33.1 or later) to prevent this information disclosure. The vulnerability is considered a hardening measure, but it is important to apply the patch to maintain the integrity of user suppression [3].