CVE-2020-35623: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within usernames. The vulnerability was disclosed on December 21, 2020 and tracked as CVE-2020-35623. The vulnerability affects the authentication mechanism of the CasAuth MediaWiki extension (AttackerKB).

The vulnerability stems from improper username validation that allows attackers to manipulate usernames using specific character modifications. The two main attack vectors involve: 1) bidirectional override symbols and 2) blank space characters. An ordinary user could potentially login as a "bureaucrat user" who has a similar username by exploiting these character manipulations (AttackerKB).

The vulnerability allows user impersonation, where an ordinary user may be able to login as a "bureaucrat user" who has a similar username. This could lead to privilege escalation and unauthorized access to administrative functions (AttackerKB).

The vulnerability is exploitable through network access and requires no authentication. An attacker can exploit this by manipulating usernames using bidirectional override symbols or blank space characters to impersonate users with higher privileges (AttackerKB).

A security patch was developed that blocks additional characters that are mapped or stripped from usernames. The fix includes blocking bidirectional override symbols and various forms of blank space, making it harder to masquerade as a bureaucrat user. The patch also includes rejection of usernames with invalid Unicode characters (GitHub PR).