CVE-2019-19709

Vulnerability

CVE-2019-19709 is a security bypass in MediaWiki up to version 1.33.1 that allows attackers to circumvent the Title_blacklist protection mechanism. The bug occurs when a page is created with an arbitrary title, then a non-resolvable redirect is established for that page, and the page is edited via the action API with the redirect=1 parameter. Under these conditions, the blacklist check is not properly applied, enabling the creation of pages that should be blocked [1][2].

Exploitation

An attacker can exploit this vulnerability by first creating a page with a title that would normally be blocked, setting up a redirect that does not resolve, and then using the API's redirect=1 parameter to edit the page. This bypasses the Title_blacklist filter, which is intended to prevent the creation of malicious or unwanted page titles. The attack does not require any special privileges beyond the ability to create and edit pages [2].

Impact

Successful exploitation allows an attacker to create pages with titles that are explicitly forbidden by the Title_blacklist, such as spam, offensive names, or pages that mimic system functions. This can lead to content policy violations, confusion, and potential abuse of wiki resources [1].

Mitigation

The vulnerability has been patched in MediaWiki version 1.34 and later, and fixes were backported to supported release branches. Users are strongly advised to upgrade to a patched version. The issue was discovered and disclosed through Wikimedia's security process, and a CVE was assigned [2][3].