Page MenuHomePhabricator

CVE-2024-40596: Special:Investigate can expose suppressed information for log events
Closed, ResolvedPublic2 Estimated Story PointsBUG REPORT

Description

Splitting from T316414. Not setting as a security ticket as the cat is out of the bag.

Log actions stored by CheckUser that are in the logging table (and thus can be suppressed) are not hidden as CheckUser does not store the log ID so that it can look up the revision deletion status. This means that checkusers who do not have the oversight permissions can access oversighted logs.

To do this CheckUser needs to store any associated log ID. This will be done in T324907. Once this has been achieved this can be fixed.

Related Objects

View Standalone Graph
This task is connected to more than 200 other tasks. Only direct parents and subtasks are shown here. Use View Standalone Graph to show more of the graph.

Event Timeline

Change #1034100 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] [WIP] Add read new support to Timeline mode

https://gerrit.wikimedia.org/r/1034100

Change #1034524 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/CheckUser@master] Update TimelineRowFormatter to read new for event table migration

https://gerrit.wikimedia.org/r/1034524

Change #1034524 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Update TimelineRowFormatter to read new for event table migration

https://gerrit.wikimedia.org/r/1034524

Change #1034100 merged by jenkins-bot:

[mediawiki/extensions/CheckUser@master] Add read new support to the TimelineService

https://gerrit.wikimedia.org/r/1034100

dom_walden subscribed.

I can no longer see suppressed information for log events as a user without suppressor rights.

Test environment: local docker CheckUser 2.5 (ff30d8b) 12:09, 28 May 2024.

mmartorana renamed this task from Special:Investigate can expose suppressed information for log events to CVE-2024-40596: Special:Investigate can expose suppressed information for log events.Jul 8 2024, 5:35 PM