Attack Chain

1. Attacker sends a request to api.php?action=query&meta=tokens&type=csrf to retrieve the anonymous session CSRF token.
2. The server responds with the default public token value +\.
3. Attacker constructs an HTTP POST request to api.php?action=smwtask using the +\ token to satisfy the CSRF check.
4. Attacker calls table-statistics via the task parameter to enumerate internal object-ID spaces and database metrics.
5. Attacker calls insert-job to enqueue administrative tasks, such as smw.entityIdDisposer or smw.fulltextSearchTableRebuild, targeting specific wiki identifiers.
6. Attacker calls run-joblist with a serialized parameters object to force synchronous execution of the injected maintenance jobs.
7. The application executes the requested administrative jobs with the privileges of the system backend, resulting in unauthorized data modification or performance degradation.

Impact

Successful exploitation allows unauthenticated actors to bypass access controls intended for administrators. Observed consequences include unauthorized disclosure of database internal structures and statistics, resource exhaustion via forced synchronous job execution, and the modification or deletion of semantic data entities. The severity of the impact scales with the size of the wiki's semantic store and the criticality of the targeted maintenance operations.

Recommendation

Prioritize the immediate remediation of affected Semantic MediaWiki instances by upgrading to version 7.3.0 or later. If an immediate upgrade is not feasible, implement a hotfix in the site's LocalSettings.php to unregister the vulnerable API module:

$wgExtensionFunctions[] = static function () {
 unset( $GLOBALS['wgAPIModules']['smwtask'] );
};

Deploy detection rules to monitor for anomalous POST requests to the api.php endpoint containing action=smwtask and verify the identity of the requesting user.