DynamicPageList3 Usernames Exposure Vulnerability

A vulnerability in the DynamicPageList3 extension for MediaWiki allows for the leakage of usernames that have been hidden through revision deletion, suppression, or the hideuser block flag. This issue arises because several #dpl parameters can inadvertently reveal these concealed identities. The vulnerability is present in versions prior to 3.6.3 and has been patched in version 3.6.4.

Impact

Exploitation of this vulnerability leads to the unauthorized disclosure of usernames that were intentionally hidden, thereby violating privacy measures established by administrators.

Reproduction

To reproduce this vulnerability, first, create a page as a user and then use revision deletion or suppression to hide the username from the page history. Afterward, employ a DPL query with one of the affected parameters, such as 'addauthor' or 'lastrevisionbefore', combined with a placeholder that outputs the username. The query result will reveal the previously hidden username.

Remediation

Users can update to DynamicPageList3 version 3.6.4 to address this vulnerability.