All,
I was hit by a mediawiki exploit that past week that affected versions at least up to and including 122.2. I am still working to determine the exact exploit used or whether this may be a new one. From what I can gather, either by cross-site-scripting (XSS) or cross-site request forgery (CSRF) an exploit existed that allowed an attacker to bypass the normal page/user creation protections, captcha and response e-mail to generate an account and gain privileges to use wiki mail for outbound spam. The postfix smtp sender/client restrictions were defeated by sending outbound as a valid system user using the UID of the web-user (e.g. http, www, etc.).
This attack is automated and will generate thousands of users/pages and outbound mails in a relatively short amount of time. Since the inbound connection is via http (instead of say a login attempt via ssh), the normal anvil/fail2ban restrictions are not implicated. After reviewing the listed CVE's at:
http://www.cvedetails.com/product/4125/Mediawiki-Mediawiki.html?vendor_id=23...
I'm not sure this exploit is among those listed. Mediawiki seems to be the only web-application affected by this exploit.
So, if you run mediawiki, update to the latest 1.23.3 and check your logs often. If you are hit and need to get rid of 10,000 additions to your server, drop a reply. Direct deletion/truncation from the mysql tables themselves are easiest way to recover.
On 21/09/14 18:20, David C. Rankin wrote:
All,
I was hit by a mediawiki exploit that past week that affected versions at least up to and including 122.2. I am still working to determine the exact exploit used or whether this may be a new one. From what I can gather, either by cross-site-scripting (XSS) or cross-site request forgery (CSRF) an exploit existed that allowed an attacker to bypass the normal page/user creation protections, captcha and response e-mail to generate an account and gain privileges to use wiki mail for outbound spam. The postfix smtp sender/client restrictions were defeated by sending outbound as a valid system user using the UID of the web-user (e.g. http, www, etc.).
This attack is automated and will generate thousands of users/pages and outbound mails in a relatively short amount of time. Since the inbound connection is via http (instead of say a login attempt via ssh), the normal anvil/fail2ban restrictions are not implicated. After reviewing the listed CVE's at:
http://www.cvedetails.com/product/4125/Mediawiki-Mediawiki.html?vendor_id=23...
I'm not sure this exploit is among those listed. Mediawiki seems to be the only web-application affected by this exploit.
So, if you run mediawiki, update to the latest 1.23.3 and check your logs often. If you are hit and need to get rid of 10,000 additions to your server, drop a reply. Direct deletion/truncation from the mysql tables themselves are easiest way to recover.
Isn't mediawiki part of the LibreOffice suite?
I just happen to download LO v4.3.1 and before installing it had to delete v4.3.0 and while doing so saw mediawiki flash by as it was being deleted.
BC
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
BC
* Basil Chupin blchupin@iinet.net.au [09-21-14 09:21]:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Then it appears somewhat odd that none of LO is required to install/use mediawiki. Nor is any of mediawiki required by LO ???
On 21/09/14 23:33, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:21]:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Then it appears somewhat odd that none of LO is required to install/use mediawiki. Nor is any of mediawiki required by LO ???
Look for yourself in YaST and then you can tell *me* the answer :-) .
LO installs a mediawiki related 5.1MB file - a plugin I believe.
What relationship it has to what David's Mediawiki I don't know but I hardly think that there would be more than one file allowed to be called mediawiki. But then....what do I know?
BC
* Basil Chupin blchupin@iinet.net.au [09-21-14 09:56]:
On 21/09/14 23:33, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:21]:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Then it appears somewhat odd that none of LO is required to install/use mediawiki. Nor is any of mediawiki required by LO ???
Look for yourself in YaST and then you can tell *me* the answer :-) .
I did that and see no requirement for any of mediawiki to install LO and do not have any answer to "rpm -qa *wiki*" on my system nor do I see any requirement in yast.
On 22/09/14 00:22, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:56]:
On 21/09/14 23:33, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:21]:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Then it appears somewhat odd that none of LO is required to install/use mediawiki. Nor is any of mediawiki required by LO ???
Look for yourself in YaST and then you can tell *me* the answer :-) .
I did that and see no requirement for any of mediawiki to install LO and do not have any answer to "rpm -qa *wiki*" on my system nor do I see any requirement in yast.
Ooow, you are a hard man to convince! :-D
A screen grab from YaST for a search on 'mediawiki':
BC
* Basil Chupin blchupin@iinet.net.au [09-21-14 10:47]:
On 22/09/14 00:22, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:56]:
On 21/09/14 23:33, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:21]:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote: >Isn't mediawiki part of the LibreOffice suite? AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Then it appears somewhat odd that none of LO is required to install/use mediawiki. Nor is any of mediawiki required by LO ???
Look for yourself in YaST and then you can tell *me* the answer :-) .
I did that and see no requirement for any of mediawiki to install LO and do not have any answer to "rpm -qa *wiki*" on my system nor do I see any requirement in yast.
Ooow, you are a hard man to convince! :-D
A screen grab from YaST for a search on 'mediawiki':
Which shows an installable extension for LO to interact with mediawiki content. NOT a requirement nor even an suggestion.
STILL not convinced :^)
see: http://wahoo.no-ip.org/~pat/YaST_search_for_mediawiki.jpg
getting harderer
On 22/09/14 01:19, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 10:47]:
On 22/09/14 00:22, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:56]:
On 21/09/14 23:33, Patrick Shanahan wrote:
- Basil Chupin blchupin@iinet.net.au [09-21-14 09:21]:
On 21/09/14 23:14, Carlos E. R. wrote: > On 2014-09-21 15:02, Basil Chupin wrote: >> Isn't mediawiki part of the LibreOffice suite? > AFAIK, no. Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Then it appears somewhat odd that none of LO is required to install/use mediawiki. Nor is any of mediawiki required by LO ???
Look for yourself in YaST and then you can tell *me* the answer :-) .
I did that and see no requirement for any of mediawiki to install LO and do not have any answer to "rpm -qa *wiki*" on my system nor do I see any requirement in yast.
Ooow, you are a hard man to convince! :-D
A screen grab from YaST for a search on 'mediawiki':
Which shows an installable extension for LO to interact with mediawiki content. NOT a requirement nor even an suggestion.
STILL not convinced :^)
see: http://wahoo.no-ip.org/~pat/YaST_search_for_mediawiki.jpg
getting harderer
Ooooh, you lucky man! :-D
BC
On 2014-09-21 15:20, Basil Chupin wrote:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Yes, and you can see also mediawiki related docbook xml stylesheets. But that is not "mediawiki" itself, just things to write for it. You may even have a library (libmediawiki1).
MediaWiki is what runs the wikipedia, or the openSUSE wiki site, for instance.
http://en.wikipedia.org/wiki/MediaWiki
«MediaWiki is a free and open-source wiki app, used to power wiki websites such as Wikipedia, Wiktionary and Commons, developed by the Wikimedia Foundation and others. It also runs thousands of other websites.[1] It is written in the PHP programming language and uses a backend database.»
On 22/09/14 00:21, Carlos E. R. wrote:
On 2014-09-21 15:20, Basil Chupin wrote:
On 21/09/14 23:14, Carlos E. R. wrote:
On 2014-09-21 15:02, Basil Chupin wrote:
Isn't mediawiki part of the LibreOffice suite?
AFAIK, no.
Do you a search in YaST;s file manager for 'mediawiki' and you will find that it is part of LibreOffice. There are 2 entries for it - one for LO and another for some interface for MediaWiki for web service.
Yes, and you can see also mediawiki related docbook xml stylesheets. But that is not "mediawiki" itself, just things to write for it. You may even have a library (libmediawiki1).
MediaWiki is what runs the wikipedia, or the openSUSE wiki site, for instance.
http://en.wikipedia.org/wiki/MediaWiki
«MediaWiki is a free and open-source wiki app, used to power wiki websites such as Wikipedia, Wiktionary and Commons, developed by the Wikimedia Foundation and others. It also runs thousands of other websites.[1] It is written in the PHP programming language and uses a backend database.»
OK, so one can now assume that what is currently installed in oS for LO is immune and therefore safe from the exploit which David mentions?
BC
On 09/21/2014 09:48 AM, Basil Chupin wrote:
On 22/09/14 00:21, Carlos E. R. wrote:
On 2014-09-21 15:20, Basil Chupin wrote: Yes, and you can see also mediawiki related docbook xml stylesheets. But that is not "mediawiki" itself, just things to write for it. You may even have a library (libmediawiki1).
MediaWiki is what runs the wikipedia, or the openSUSE wiki site, for instance.
http://en.wikipedia.org/wiki/MediaWiki
«MediaWiki is a free and open-source wiki app, used to power wiki websites such as Wikipedia, Wiktionary and Commons, developed by the Wikimedia Foundation and others. It also runs thousands of other websites.[1] It is written in the PHP programming language and uses a backend database.»
OK, so one can now assume that what is currently installed in oS for LO is immune and therefore safe from the exploit which David mentions?
BC
BC, (sorry, you get 2 copies -- I forgot to change the address :( )
LO is fine. This is the mediawiki web server software itself. This was just some NASTY piece of spambot code that appears to originated in Thailand - curiously it occurred immediately following the hack that compromised/leaked ~5 million google accounts on one of google's servers in Thailand. (google claims no compromise) see:
http://www.bankinfosecurity.com/5-million-google-passwords-leaked-a-7299/op-...
Whatever the source, this is an automated exploit that bypasses all captcha and send account conf e-mail/reply account e-mail protections built into the software and can literally create 10,000 new accounts/pages as fast as your hardware will allocate it.
Then a steady stream of http requests are sent from all over the world that generate outbound mail utilizing the new wiki accounts, but outgoing as www@yourhost.com in order to defeat your smtpd_sender_restrictions and smtpd_client_restrictions.
Even though system accounts are set to /bin/false in /etc/passwd, postfix still considers the accounts valid local accounts (that was news to me - still working on an /etc/postfix/sender_access to blacklist system accounts while still allowing needed system e-mails).
An example of the http requests seen were:
198.27.127.50 - - [14/Sep/2014:23:59:44 -0500] "POST /mediawiki/index.php?title=1-2&action=submit HTTP/1.1" 302 - 37.203.210.163 - - [14/Sep/2014:23:59:44 -0500] "POST /mediawiki/index.php?title=Special:UserLogin&action=submitlogin&type=signup&returnto=Info+On+Rapid+Plans+Of+%E0%B8%9A%E0%B8%A3%E0%B8%B4%E0%B8%81%E0%B8%B2%E0%B8%A3+Seo HTTP/1.1" 200 14697 23.105.145.204 - - [14/Sep/2014:23:59:44 -0500] "GET /mediawiki/index.php/Step-By-Step_Details_Of_Cats HTTP/1.1" 200 17904 198.27.127.50 - - [14/Sep/2014:23:59:44 -0500] "GET /mediawiki/index.php/1-2 HTTP/1.1" 200 13994 195.154.179.29 - - [14/Sep/2014:23:59:45 -0500] "POST /mediawiki/index.php?title=User:DawnaNealy&action=submit HTTP/1.1" 302 - 198.27.127.50 - - [14/Sep/2014:23:59:45 -0500] "GET /mediawiki/index.php/1-2 HTTP/1.1" 200 12489 195.154.179.29 - - [14/Sep/2014:23:59:45 -0500] "GET /mediawiki/index.php/User:DawnaNealy HTTP/1.1" 200 15215 195.154.179.29 - - [14/Sep/2014:23:59:47 -0500] "GET /mediawiki/index.php/User:DawnaNealy HTTP/1.1" 200 13769 198.27.127.50 - - [14/Sep/2014:23:59:47 -0500] "GET /mediawiki/index.php/User:IKDTomfezmri HTTP/1.1" 200 13199 198.27.127.50 - - [14/Sep/2014:23:59:47 -0500] "GET /mediawiki/index.php?title=Special:UserLogin&returnto=User%3AIKDTomfezmri HTTP/1.1" 200 12744 198.27.127.50 - - [14/Sep/2014:23:59:48 -0500] "POST /mediawiki/index.php?title=Special:UserLogin&action=submitlogin&type=login&returnto=User:IKDTomfezmri HTTP/1.1" 302 - 198.27.127.50 - - [14/Sep/2014:23:59:48 -0500] "GET /mediawiki/index.php/User:IKDTomfezmri HTTP/1.1" 200 14744 198.27.127.50 - - [14/Sep/2014:23:59:49 -0500] "GET /mediawiki/index.php/User:IKDTomfezmri HTTP/1.1" 200 14744 198.27.127.50 - - [14/Sep/2014:23:59:50 -0500] "GET /mediawiki/index.php?title=User:IKDTomfezmri&action=edit HTTP/1.1" 200 19148
This was at the rate of up to ~10 per-second. There were over 35740 UNIQUE incoming IPs used with this attack (primarily from RIPE and APNIC blocks) Even after nearly 2 days of having closed the exploit, I am still receiving on average 1 per second:
209.236.112.190 - - [21/Sep/2014:14:10:47 -0500] "GET /mediawiki/index.php/How_to_Make_Quick_Money_Online HTTP/1.1" 500 1040 23.95.96.114 - - [21/Sep/2014:14:10:48 -0500] "GET /mediawiki/index.php/User:KingGarratt HTTP/1.1" 500 1040 5.39.105.45 - - [21/Sep/2014:14:10:50 -0500] "GET /mediawiki/index.php/High_Locations_To_Shop_For_Maternity_Wear HTTP/1.1" 500 1040 209.236.112.190 - - [21/Sep/2014:14:10:56 -0500] "GET /mediawiki/index.php/Making_Money_Online_Some_Key_Points_To_Note HTTP/1.1" 500 1040 117.26.194.42 - - [21/Sep/2014:14:10:56 -0500] "GET /mediawiki/index.php/User:HermeliDorron HTTP/1.1" 500 1040 195.154.179.29 - - [21/Sep/2014:14:11:02 -0500] "GET /mediawiki/index.php/User:EdwardoITLN HTTP/1.1" 500 1040 195.154.211.103 - - [21/Sep/2014:14:11:02 -0500] "GET /mediawiki/index.php/How_Essential_Is_Water_To_Your_Skin HTTP/1.1" 500 1040 5.255.88.57 - - [21/Sep/2014:14:11:04 -0500] "GET /mediawiki/index.php/Info_On_Rapid_Plans_Of_%E0%B8%9A%E0%B8%A3%E0%B8%B4%E0%B8%81%E0%B8%B2%E0%B8%A3_Seo HTTP/1.1" 500 1040 204.44.91.182 - - [21/Sep/2014:14:11:05 -0500] "GET /mediawiki/index.php/User:TashaJmzbotlg HTTP/1.1" 500 1040 5.255.88.57 - - [21/Sep/2014:14:11:10 -0500] "GET /mediawiki/index.php/User:ShariAngwin HTTP/1.1" 500 1040 209.236.112.190 - - [21/Sep/2014:14:11:22 -0500] "GET /mediawiki/index.php/User:APKSonjabqrg HTTP/1.1" 500 1040 5.39.105.45 - - [21/Sep/2014:14:11:23 -0500] "GET /mediawiki/index.php/User:JulianeMcclendo HTTP/1.1" 500 1040 5.135.43.143 - - [21/Sep/2014:14:11:27 -0500] "GET /mediawiki/index.php/User:RickeyJIXdzjd HTTP/1.1" 500 1040 195.154.179.29 - - [21/Sep/2014:14:11:29 -0500] "GET /mediawiki/index.php/User:ElanaPrince HTTP/1.1" 500 1040 89.137.140.101 - - [21/Sep/2014:14:11:30 -0500] "GET /mediawiki/index.php/Sex_Cams_-_Overview HTTP/1.1" 500 1040 155.94.220.104 - - [21/Sep/2014:14:11:32 -0500] "GET /mediawiki/index.php/Famous_People_Who_Have_Undergone_LASIK_And_Laser_Eye_Surgery_Treatments HTTP/1.1" 500 1040 5.39.105.45 - - [21/Sep/2014:14:11:32 -0500] "GET /mediawiki/index.php/Finances_Summer_season_Maternity_Style_Garments_And_Style_For_24_Week_Pregnant HTTP/1.1" 500 1040 5.39.105.45 - - [21/Sep/2014:14:11:34 -0500] "GET /mediawiki/index.php/New_Bellingham_Consignment_Store_Focuses_On_Maternity_And_Youngsters_s_Garments HTTP/1.1" 500 1040
I wonder how long this chatter will continue? They have been receiving a '500' response from my server since 9:30 Friday. In order to prevent the chatter, I would have to drop http requests from -- just about the entire internet :(
Does anyone have, or has anyone found, a way to send a nuclear reply to a specific http request? Kind of like an old honeypot? During close of business hours I was thinking about creating a 1G file of garbage and softlinking it to mediawiki/index.php -- but that has an obvious bandwidth downside... Any other slick retaliatory ideas?
Regardless, keep an eye on your mediawiki installs...
Am 21.09.2014 um 15:02 schrieb Basil Chupin:
Isn't mediawiki part of the LibreOffice suite?
Mediawiki packaged for openSUSE is currently only available in the server:php repository (currently 1.23.3); what is installed together with LO are import/export filters - there is no relation at all to the mediawiki server-package and it's security issues.
Best regards Johannes
On 22/09/14 17:27, Johannes Weberhofer wrote:
Am 21.09.2014 um 15:02 schrieb Basil Chupin:
Isn't mediawiki part of the LibreOffice suite?
Mediawiki packaged for openSUSE is currently only available in the server:php repository (currently 1.23.3); what is installed together with LO are import/export filters - there is no relation at all to the mediawiki server-package and it's security issues.
Best regards Johannes
Excellent - no worries then. "Better to be sure than sorry" someone once said :-) .
BC
-
Basil Chupin -
Carlos E. R. -
David C. Rankin -
Johannes Weberhofer -
Patrick Shanahan