Critical · published August 28, 2020
🔥 An account can be hijacked just by adding or removing underscores from the username! This MediaWiki extension flaw in Scratch Login allows users to access any account, creating a serious security risk.⚠️ Imagine if you could check into a hotel by showing a name tag that just has your name with random extra letters – no one would notice! That’s how this vulnerability allows for unauthorized login, as usernames with leading, trailing, or repeated underscores are treated as the same. 📛 This is a critical issue because an attacker could log into any user's account without their knowledge, potentially accessing private messages, altering settings, or misusing their identity. This kind of breach could have devastating consequences for user trust and data integrity on any wiki using this extension!
Imagine if you could check into a hotel by showing a name tag that just has your name with random extra letters – no one would notice! That’s how this vulnerability allows for unauthorized login, as usernames with leading, trailing, or repeated underscores are treated as the same. 📛 This vulnerability in the Scratch Login MediaWiki extension before version 1.1 allows usernames with leading, trailing, or repeated underscores to bypass authentication due to how MediaWiki handles whitespace in usernames. As a result, any account can be accessed easily. ⚡
This is a critical issue because an attacker could log into any user's account without their knowledge, potentially accessing private messages, altering settings, or misusing their identity. This kind of breach could have devastating consequences for user trust and data integrity on any wiki using this extension! To protect your users, patch it immediately by upgrading to MediaWiki Scratch Login version 1.1 or higher. Additionally, review your username policies to ensure proper verification processes are in place to handle such input issues. 🛡️ You've got this! Follow these steps to secure your wiki and keep your users safe from unauthorized access! 🌟