DEV Community

facilishz
facilishz

Posted on

The attack chain behind CVE-2026-100382, reconstructed from administrator logs

#security #vulnerability #mediawiki #attackchain

The attack chain behind CVE-2026-100382, reconstructed from administrator logs

When a MediaWiki extension can execute server-side programs, the difference between a theoretical flaw and a compromised wiki is measured in hours. CVE-2026-100382 moved from public disclosure to automated exploitation in about a day, and the logs administrators preserved show a tight, repeatable sequence. Reconstructing that sequence is what makes detection possible.

Vulnerability overview

CVE-2026-100382 is an unauthenticated remote code execution flaw in the External Data extension for MediaWiki, affecting every release before 3.7. It carries a CVSS v4 score of 10.0, has public exploitation details and a proof of concept in Wikimedia Phabricator task T434961, and is confirmed as exploited. Administrators who reported the first wave described bots hammering wikis with the extension installed within a day of the issue going public.

Mechanism and exploitation conditions

The extension gained the ability to run local programs on the server in version 3.0. Commands passed in through a parser function were not filtered, so wikitext that reached the function could specify what the server executed. The CVE record states that the flaw works without authentication or privileges. Three properties combine to make exploitation routine: the input arrives as page content, the sink is a privileged process, and nothing in the default setup requires a credential.

The observed sequence

The pattern Marc Lajoie captured on his production wiki has three phases. The first is reconnaissance: a request to the wiki API checks whether External Data is present, which lets the bot avoid spending effort on sites that will not work. The second is delivery: a burst of POST requests carries the command payload through the parser function. The third is retrieval: the attacker requests the PHP file that the injected command just wrote, converting execution into a persistent web shell. Lajoie counted 13 automated rounds on 26 September and found the shell sitting in the skins directory.

That shape matters for defenders. Each phase leaves a different artefact, and each can be detected independently, so missing one signal does not mean the intrusion is invisible.

Impact

Successful exploitation yields command execution as the web server user. From there the attacker reads LocalSettings.php, harvesting database credentials, secret keys and API keys, and can write further files into web-served directories. On a wiki, that means a site that looks like a knowledge base can be quietly serving attacker infrastructure. Recovery is not limited to patching: stolen credentials must be rotated and any webshell removed, or the attacker returns through a route that the update did not close.

Affected products and scope

All External Data releases before 3.7 are affected, on any MediaWiki version capable of running the extension. The Canasta 3.5.7 and MediaWiki 1.43.8 combination in the reported incident confirms that actively maintained platform builds are in scope. Wikis that never installed the extension are not vulnerable to this flaw.

Exposure context

A ZoomEye query for the extension's own output string, http.body="ExternalData", returned 1128 assets. This is a footprint figure for assets that mention External Data in a response, so it guides triage rather than proving that any individual host runs a vulnerable build. Compare it with the broader http.body="MediaWiki" population when prioritising a patch wave.

Remediation and mitigations

Upgrade to External Data 3.7 or disable the extension immediately. Then hunt: search writable directories for new PHP files, particularly Nx_.php and NX_.php, and review access logs from 25 September onward for API extension probes followed by POST bursts to api.php and subsequent fetches of freshly created PHP files. Block PHP execution in uploads at the web server layer, not in .htaccess, because .htaccess depends on configuration the attacker may influence. Rotate the database password, secret keys and administrator passwords, and replace API keys held in LocalSettings.php. Validate the remediation by confirming the extension version on Special:Version and by re-scanning for the shell artefacts.

References

Top comments (0)