Executive Summary

This vulnerability occurs in the MediaWiki extension 'Bucket' prior to version 1.0.0 when a user queries a repeated field using the '!=' operator. The code triggers infinite recursion between two internal functions, causing PHP's call stack or memory limits to be exceeded. This results in a denial of service by making the page inaccessible. The issue is due to uncontrolled recursion in the code handling the '!=' operator on repeated fields. [1]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a denial of service (DoS) condition by exhausting PHP's call stack or memory resources when a crafted query using the '!=' operator on repeated fields is executed. This can make the affected MediaWiki pages inaccessible, disrupting availability of the service. [1]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for PHP errors or crashes related to call stack limits or excessive memory consumption when queries using the '!=' operator on repeated fields in the Bucket extension are executed. Specifically, you can look for logs indicating PHP fatal errors due to maximum function nesting level or memory exhaustion. Additionally, testing with Lua module queries such as `bucket('test').select('testfield').where('testfield', '!=', 'abc').run()` on a system running a vulnerable version (prior to 1.0.0) can reproduce the issue. There are no specific network commands provided, but checking MediaWiki logs and PHP error logs for such symptoms is recommended. [1]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade the MediaWiki Bucket extension to version 1.0.0 or later, which contains the patch fixing the infinite recursion issue. If upgrading is not immediately possible, avoid using the '!=' comparator on repeated fields in Bucket queries to prevent triggering the recursion. Monitoring and restricting user queries that use this operator can also help mitigate the risk until the patch is applied. [1, 2]

Useful 0 Not Useful 0