CVE-2023-45361

What it actually does

An uncaught MalformedTitleException occurs in VectorComponentUserLinks.php when the vector-intro-page parameter contains an invalid title, resulting in improper exception handling and generation of incorrect web page output.

Why it matters to the business

Users may encounter malformed or unexpected page content, causing confusion, degraded user experience, and potential minor information leakage in public-facing wiki instances.

How an attack unfolds

An attacker supplies a crafted request containing an invalid title value for the vector-intro-page parameter to a MediaWiki instance using the Vector skin; the uncaught exception bypasses normal error handling and produces erroneous page output.

How to fix it

Upgrade MediaWiki to version 1.39.5 or 1.40.1 (or later) to ensure the exception is properly caught and handled.

How to confirm the fix worked

Verify installed MediaWiki version is at least 1.39.5 or 1.40.1; test by submitting requests with invalid vector-intro-page titles and confirm normal error handling occurs instead of malformed output.

Typical attack path

1. Identify MediaWiki instance using Vector skin
2. Craft URL or request with invalid title in vector-intro-page parameter
3. Submit request to trigger uncaught MalformedTitleException
4. Observe resulting incorrect web page content

How to detect it

Search application and web server logs for references to MalformedTitleException combined with vector-intro-page parameter values; inspect for unexpected page rendering artifacts in access logs.

• MalformedTitleException
• vector-intro-page

What your security team should do

• Upgrade all MediaWiki installations to the fixed versions immediately
• Review web server and application logs for prior instances of MalformedTitleException
• Implement input validation monitoring for title parameters