MediaWiki Lockdown Extension Privilege Abuse Vulnerability

A vulnerability in the MediaWiki Lockdown Extension allows users with read permission to access content that should be protected. This issue arises because the Action API module 'compare' fails to properly check permissions, enabling unauthorized access to restricted content. The vulnerability affects MediaWiki Lockdown Extension versions prior to 1.42.

Impact

Exploitation of this vulnerability allows unauthorized users to access protected content through the Action API, bypassing the intended restrictions of the Lockdown Extension.

Reproduction

To reproduce this vulnerability, use the Action API 'compare' module. Specify the 'fromid' parameter with the current ID of a protected article and the 'toid' parameter with '1'. This request will return a comparison that includes content from the protected article, demonstrating the unauthorized access.

Remediation

This vulnerability has been fixed in MediaWiki core versions 1.42, 1.43, and 1.44. Users should update to one of these versions.