GHSA-24v2-mf3g-84ch: Semantic MediaWiki 3.0.0 before 7.4.1 DoS via Exponential Concept Expansion
Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore ConceptDescriptionInterpreter classes, which re-expand concepts without memoization or an expansion budget. Users with page-edit rights can build acyclic chains of Concept: pages that fan out, so queries via concept page views, Special:Ask, or api.php action=ask exhaust CPU and memory.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs page-edit rights to create Concept: pages that form acyclic, fan-out chains. No user interaction is required after the malicious concepts are created.
Which deployments are affected?
The issue affects Semantic MediaWiki versions from 3.0.0 before 7.4.1 when using the ElasticStore or SPARQLStore ConceptDescriptionInterpreter classes. Queries that expand concepts through concept page views, Special:Ask, or api.php?action=ask can trigger the resource exhaustion.
What can be done if updating is not immediately possible?
Restrict page-edit rights for untrusted users, particularly access that permits creation or modification of Concept: pages. Limit or monitor concept-expanding query endpoints such as Special:Ask and api.php?action=ask until an update can be applied.
How can administrators identify attempted exploitation?
Review Concept: pages for acyclic dependency chains with broad fan-out and correlate them with high CPU or memory use during concept page views, Special:Ask requests, or api.php?action=ask queries.