CVE-2023-29141

The vulnerability CVE-2023-29141 resides in MediaWiki's handling of the X-Forwarded-For HTTP header. The software incorrectly trusts the value of this header when determining the client's IP address for automatic blocking purposes. An attacker can supply a spoofed X-Forwarded-For header containing an arbitrary IP address, leading MediaWiki's auto-block mechanism to act on that crafted address. [1]

To exploit this flaw, an attacker needs to be able to send HTTP requests with a manipulated X-Forwarded-For header to a vulnerable MediaWiki instance. No authentication is required because the auto-block logic is triggered by request metadata before any permissions check. The attack surface is the public-facing web interface; any request reaching the wiki can carry a spoofed header. [2]

Successful exploitation causes MediaWiki to auto-block the IP address injected into the X-Forwarded-For header, potentially blocking legitimate users or administrators who share that IP range. The impact is a denial of service against valid users, as their IP becomes subject to a block erroneously attributed by the forged header. [3]

MediaWiki addressed the issue in versions 1.35.10, 1.38.6, and 1.39.3, released in March 2023. Administrators running older builds should upgrade immediately to one of these patched releases or a later version. The fix likely involves sanitizing or ignoring untrusted proxy headers for block decisions. [1][4]