CVE-2020-25827

An issue in the OATHAuth extension for MediaWiki allows attackers to bypass rate limiting on TOTP token validation. In wiki farms or clusters using CentralAuth, the rate limit for OATH tokens is enforced only on a per-site basis, not globally [1][2]. This means the limit is not shared across multiple wikis.

To exploit this, an attacker can simultaneously submit many TOTP validation requests across different wikis. Since each site has its own counter, the attacker can effectively multiply the allowed attempts by the number of wikis. The pingLimiter function, which enforces limits, counts 'user' and 'anon' limits per wiki, while 'ip' and 'subnet' limits are cross-wiki, but the default configuration only uses per-user limits for the badoath action [3].

Successful exploitation enables brute-force attacks on two-factor authentication tokens, potentially compromising accounts protected by TOTP. This undermines the security of OATHAuth, as an attacker can guess tokens faster than intended [2][3].

The vulnerability is fixed in MediaWiki 1.31.10, 1.34.4, and later versions. Administrators should upgrade to these releases or apply a workaround by configuring per-IP or per-subnet limits for the 'badoath' action in InitialSettings.php, as suggested in the Phabricator task [4].