Unauthenticated Administrative Access in Semantic MediaWiki smwtask API

Semantic MediaWiki versions 3.0.0 through 7.2.1 contain a critical authorization vulnerability in the smwtask API module. The module implements a needsToken('csrf') check, but because MediaWiki provides a fixed, public CSRF token (+\) to anonymous users, this check fails to prevent unauthenticated access. Consequently, an attacker can invoke administrative tasks that are otherwise restricted to users with the smw-admin right via the Special:SMWAdmin web interface. The vulnerability allows attackers to query internal database statistics, enumerate object IDs, inject arbitrary maintenance jobs (such as fulltext search rebuilds or entity disposal), and force synchronous job execution, leading to both information disclosure and potential data integrity loss.

Attack Chain

1. Attacker sends a request to api.php?action=query&meta=tokens&type=csrf to retrieve the anonymous session CSRF token.
2. The server responds with the default public token value +\.
3. Attacker constructs an HTTP POST request to api.php?action=smwtask using the +\ token to satisfy the CSRF check.
4. Attacker calls table-statistics via the task parameter to enumerate internal object-ID spaces and database metrics.
5. Attacker calls insert-job to enqueue administrative tasks, such as smw.entityIdDisposer or smw.fulltextSearchTableRebuild, targeting specific wiki identifiers.
6. Attacker calls run-joblist with a serialized parameters object to force synchronous execution of the injected maintenance jobs.
7. The application executes the requested administrative jobs with the privileges of the system backend, resulting in unauthorized data modification or performance degradation.

Impact

Successful exploitation allows unauthenticated actors to bypass access controls intended for administrators. Observed consequences include unauthorized disclosure of database internal structures and statistics, resource exhaustion via forced synchronous job execution, and the modification or deletion of semantic data entities. The severity of the impact scales with the size of the wiki's semantic store and the criticality of the targeted maintenance operations.

Recommendation

Prioritize the immediate remediation of affected Semantic MediaWiki instances by upgrading to version 7.3.0 or later. If an immediate upgrade is not feasible, implement a hotfix in the site's LocalSettings.php to unregister the vulnerable API module:

$wgExtensionFunctions[] = static function () {
 unset( $GLOBALS['wgAPIModules']['smwtask'] );
};

Deploy detection rules to monitor for anomalous POST requests to the api.php endpoint containing action=smwtask and verify the identity of the requesting user.