CVE-2024-40608: Special:Investigate exposes suppressed usernames to those who do not have the rights to see them
Closed, ResolvedPublic2 Estimated Story PointsSecurity
Actions

Assigned To

Authored By

	Dreamy_Jazz
	Mar 28 2024, 8:11 PM

Description

If a user with the checkuser group, but not the suppressor group, uses Special:Investigate to check an IP address which has been used by a user that has been blocked with hideuser, then the username of the hidden user will be displayed in all the tabs on the page.

For example:

The block entry with `hideuser` set	Leak on the 'Account information' tab	Leak on the 'IPs and User agents' tab	Leak on the 'Timeline' tab	The contributions page for that hidden user

Steps to reproduce

Block a user with hideuser enabled using an account with the suppressor group
Log into an account with just the checkuser group
Open Special:Investigate and run a check on an IP address used by the account that was blocked in step 2
Search for the username of the blocked user in any of the tabs presented

Details

Author Affiliation: WMF Technology Dept

Subject	Repo	Branch	Lines +/-
SECURITY: Hide users hidden users in Special:Investigate	mediawiki/extensions/CheckUser	REL1_39	+152 -25
SECURITY: Hide users hidden users in Special:Investigate	mediawiki/extensions/CheckUser	REL1_40	+162 -29
SECURITY: Hide users hidden users in Special:Investigate	mediawiki/extensions/CheckUser	REL1_41	+152 -29
SECURITY: Hide users hidden users in Special:Investigate	mediawiki/extensions/CheckUser	master	+152 -29

Customize query in gerrit

Related Objects

Mentioned In: T240586: Should hidden blocks be shown in Preliminary Check?
T361321: Write and send supplementary release announcement for extensions and skins with security patches (1.39.8/1.40.4/1.41.2/1.42.0)
Mentioned Here: rECHU5f204f21a176: Localisation updates from https://translatewiki.net.
T326866: CVE-2024-40596: Special:Investigate can expose suppressed information for log events

Event Timeline

Dreamy_Jazz created this task.Mar 28 2024, 8:11 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 28 2024, 8:12 PM

Dreamy_Jazz added projects: CheckUser, Trust and Safety Product Team, Vuln-Infoleak.Mar 28 2024, 8:12 PM

Dreamy_Jazz attached a referenced file: F43689992: image.png. (Show Details)

Dreamy_Jazz attached a referenced file: F43690027: image.png. (Show Details)

Dreamy_Jazz updated the task description. (Show Details)

Dreamy_Jazz added a project: Trust and Safety Product Sprint (Sprint Tabla (1st - 14th April)).Mar 28 2024, 8:14 PM

Dreamy_Jazz added subscribers: Tchanders, STran, kostajh.

Dreamy_Jazz moved this task from Priority Backlog to In Progress on the Trust and Safety Product Sprint (Sprint Tabla (1st - 14th April)) board.Apr 2 2024, 11:39 AM

Dreamy_Jazz claimed this task.Apr 2 2024, 1:58 PM

Dreamy_Jazz set the point value for this task to 2.

sbassett mentioned this in T361321: Write and send supplementary release announcement for extensions and skins with security patches (1.39.8/1.40.4/1.41.2/1.42.0).Apr 2 2024, 5:53 PM

sbassett added a project: security-bug.Apr 2 2024, 6:02 PM

sbassett moved this task from Incoming to Watching on the Security-Team board.Apr 2 2024, 6:23 PM

sbassett added a project: SecTeam-Processed.

Proposed patch:

T361296-01.patch24 KBDownload

In T361296#9681940, @Dreamy_Jazz wrote:

Proposed patch:

T361296-01.patch24 KBDownload

All of the $userIsHidden = logic makes sense to me after a quick look. I can try to test this a bit locally this week, though if someone who works more closely with CU can give it a +2, that would likely be preferred.

In T361296#9682434, @sbassett wrote:

In T361296#9681940, @Dreamy_Jazz wrote:

Proposed patch:

T361296-01.patch24 KBDownload

All of the $userIsHidden = logic makes sense to me after a quick look. I can try to test this a bit locally this week, though if someone who works more closely with CU can give it a +2, that would likely be preferred.

I think @Tchanders may be able to do a full review as I've included this (and the other security tasks) in our current sprint.

Looks good to me too: +2.

Note that it won't hide deleted log entries, but that's because Special:Investigate is still reading the old schema, so can't join on the logging table - already captured in T326866.

@Dreamy_Jazz - I assume you can get this deployed, but let the Security-Team know if you'd just like us to do that. Thanks.

I'll get this deployed now.

Deployed.

Dreamy_Jazz added a project: MW-1.42-notes (1.42.0-wmf.25; 2024-04-02).Apr 4 2024, 5:37 PM

Dreamy_Jazz moved this task from In Progress to Needs QA on the Trust and Safety Product Sprint (Sprint Tabla (1st - 14th April)) board.Apr 4 2024, 7:23 PM

Dreamy_Jazz added a subscriber: gerritbot.

Change #1016881 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@REL1_39] SECURITY: Hide users hidden users in Special:Investigate

https://gerrit.wikimedia.org/r/1016881

Dreamy_Jazz added subscribers: Djackson-ctr, dom_walden, GMikesell-WMF.Apr 4 2024, 7:25 PM

I have removed the patch from the deployment server since it got merged and made its way to the MediaWiki deployment train this week.

Dreamy_Jazz mentioned this in T240586: Should hidden blocks be shown in Preliminary Check?.Apr 12 2024, 9:20 AM

Dreamy_Jazz moved this task from General / Unsorted to Investigate on the CheckUser board.Apr 12 2024, 10:19 AM

I cannot see the username of a suppressed user in the "Username" column of the "IPs & User Agents" tab nor in the place where usernames are normally displayed in the "Timeline" tab.

However, you can see the username in the log details on the "Timeline" tab, even if the associated log/revision is hidden. @Dreamy_Jazz are we implementing this elsewhere?

Test environment: local docker CheckUser 2.5 (5f204f2) 07:27, 15 April 2024.

In T361296#9712753, @dom_walden wrote:

However, you can see the username in the log details on the "Timeline" tab, even if the associated log/revision is hidden. @Dreamy_Jazz are we implementing this elsewhere?

This will be done through T326866: CVE-2024-40596: Special:Investigate can expose suppressed information for log events.

Dreamy_Jazz closed this task as Resolved.Apr 15 2024, 5:43 PM

mmartorana renamed this task from Special:Investigate exposes suppressed usernames to those who do not have the rights to see them to CVE-2024-40608: Special:Investigate exposes suppressed usernames to those who do not have the rights to see them.Jul 8 2024, 5:32 PM

hashar unsubscribed.Jul 8 2024, 9:04 PM

mmartorana changed the visibility from "Custom Policy" to "Public (No Login Required)".Jul 10 2024, 8:52 AM

	F46746046: specialinvestigate_log_reason.png
	Apr 15 2024, 10:33 AM

	F44201295: T361296-01.patch
	Apr 2 2024, 6:48 PM

CVE-2024-40608: Special:Investigate exposes suppressed usernames to those who do not have the rights to see themClosed, ResolvedPublic2 Estimated Story PointsSecurityActions