| Bawolff | |
| Jun 8 2016, 2:22 AM |
| F4141510: 0001-SECURITY-XSS-in-unclosed-internal-links.patch | |
| Jun 8 2016, 2:42 AM |
Put
[[#%3Cscript%3Ealert(1)%3C/script%3E|
On a line by itself, and you get an XSS.
It appears that this was fixed in the main code branch in r13302 by @GWicke, but the e1_img code patch was missed. The e1_img code path was added in r5693, so this issue basically effects all versions of MW ever.
@Legoktm helped discover this vulnrability
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • demon | T133070 MediaWiki 1.27.1 security release | |||
| Resolved | • dpatrick | T137264 XSS in Parser::replaceInternalLinks2 during replacement of percent encoding in unclosed internal links |
For reference:
This patch has been deployed:
21:16 dapatrick: Deployed patch for T137264 to wmf.5 and wmf.6
Change 306129 had a related patch set uploaded (by Ejegg):
SECURITY: XSS in unclosed internal links
Point of interest, it appears that this vulnerability was at least attempted to be used in the wild. The script mentioned in T419143 appears to attempt to use it. Obviously in Wikimedia's case it has long since been patched, however it appears that that script may have been copied and originally targeted at other wikis. Its hard to know when the script was originally written, but its probable the original target was using an outdated version of MediaWiki at the time and was vulnerable.