CVE-2021-41118 : Security Advisory and Response

The DynamicPageList3 extension for MediaWiki was susceptible to a ReDoS vulnerability due to unsanitized input in regular expression dates. This vulnerability has been assigned CVE-2021-41118.

Understanding CVE-2021-41118

This section delves into the impact, technical details, and mitigation steps regarding CVE-2021-41118.

What is CVE-2021-41118?

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions, unsanitized input of regular expression dates within the DPL parser function parameters opened the door to ReDoS (Regex Denial of Service) attacks.

The Impact of CVE-2021-41118

The impact is categorized as a medium severity issue with a CVSS base score of 5.3. The attack vector is through the network with high availability impact, requiring user interaction for exploitation.

Technical Details of CVE-2021-41118

This section outlines the vulnerability description, affected systems and versions, and the exploitation mechanism.

Vulnerability Description

The vulnerability in DynamicPageList3 allowed for ReDoS attacks due to unsanitized regular expression date input within the parser function.

Affected Systems and Versions

Product: DynamicPageList3
Vendor: Universal-Omega
Versions Affected: < 3.3.6

Exploitation Mechanism

The vulnerability could be exploited by malicious actors sending crafted requests containing malicious regex patterns to trigger a denial of service condition.

Mitigation and Prevention

Mitigation steps and long-term security practices are crucial to prevent exploitation.

Immediate Steps to Take

Update to version 3.3.6 or above to patch the vulnerability
Set

$wgDplSettings['functionalRichness'] = 0;

as a temporary mitigation
Disable DynamicPageList3 if immediate patching is not possible

Long-Term Security Practices

Regularly update extensions and software components
Implement input validation and sanitization in extension development

Patching and Updates

Ensure timely installation of security updates and patches released by Universal-Omega for DynamicPageList3.