CVE-2020-35626 Explained : Impact and Mitigation
Discover the CSRF vulnerability in the PushToWatch extension for MediaWiki through version 1.35.1. Learn about the impact, affected systems, exploitation, and mitigation steps.
An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was completely vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.
Understanding CVE-2020-35626
This CVE identifies a vulnerability in the PushToWatch extension for MediaWiki that could be exploited for CSRF attacks.
What is CVE-2020-35626?
The vulnerability in the PushToWatch extension for MediaWiki through version 1.35.1 allows for CSRF attacks due to the absence of an anti-CSRF token in the primary form.
The Impact of CVE-2020-35626
The vulnerability could be exploited by attackers to perform CSRF attacks against onSkinAddFooterLinks in PushToWatch.php, potentially leading to unauthorized actions being performed on behalf of a user.
Technical Details of CVE-2020-35626
This section provides more technical insights into the CVE.
Vulnerability Description
The primary form in the PushToWatch extension for MediaWiki through version 1.35.1 lacks an anti-CSRF token, making it susceptible to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.
Affected Systems and Versions
- Product: MediaWiki
- Vendor: N/A
- Versions affected: All versions through 1.35.1
Exploitation Mechanism
The vulnerability can be exploited by malicious actors to execute CSRF attacks against the onSkinAddFooterLinks function in PushToWatch.php.
Mitigation and Prevention
Protecting systems from this vulnerability requires immediate actions and long-term security practices.
Immediate Steps to Take
- Disable or remove the PushToWatch extension if not essential
- Implement proper anti-CSRF measures in the affected extension
Long-Term Security Practices
- Regularly update software and extensions to the latest secure versions
- Conduct security audits to identify and address vulnerabilities proactively
Patching and Updates
- Apply patches or updates provided by MediaWiki to address the CSRF vulnerability in the PushToWatch extension.