Hi,
When scanning my wiki with Rapid7 Nexpose I get the following vulnerability:
Form with action https://wiki.example.url/index.php/Special:UserLogin does not explicitly disable autocomplete for the following sensitive fields: wpPassword
Is there a simple way to fix this? I looked at LoginSignupSpecialPage.php, but found no easy way to fix it myself. Any help regarding this issue is highly appreciated.
Best regards.
Paddy
It’s questionable how well this actually works — many browsers seem to ignore it — but it’s probably
what you want to add:
autocomplete=“off”
However, if you ask me, this is not a security problem. It is a company trying to make money from people's fears, which the company created itself.
Since LoginSignupSpecialPage.php is not plain php it's not easy to add autocomplete="off" (I would not know where to add it, anyway). Another thing is that any modification made to such files are likely to be gone after updating MediaWiki.
About your comment ... (in my case) it's not fear. It's a simple case of risk management where in this case I have to assess likelyhood and impact. When a simple modification can be made to make things safer, it's worth a try :D
If you are on latest mediawiki, change value of $mAutocomplete in this line from false to off - https://github.com/wikimedia/mediawiki/blob/a65a3516055e5fe3e4d44ee1efd84d4754946a58/includes/htmlform/HTMLForm.php#L219
This will turn off autocomplete for all forms
