| Schnark | |
| Jul 7 2016, 8:51 AM |
| F4284748: T139565-REL1_27.patch | |
| Jul 18 2016, 8:31 AM |
| F4284747: T139565-REL1_26.patch | |
| Jul 18 2016, 8:31 AM |
| F4284745: T139565-REL1_23.patch | |
| Jul 18 2016, 8:31 AM |
https://en.wikipedia.org/w/api.php?action=parse&page=Project:Sandbox&prop=headhtml&format=json&callback=foo includes data like wgUserName and private user settings (mw.user.options.set) when you are logged in. Instead it should (like https://en.wikipedia.org/w/api.php?action=parse&text=~~~~&pst&format=json&callback=foo does) treat the user as anon, when in JSONP mode (i.e. when the callback parameter is present).
1.27:
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | • demon | T133070 MediaWiki 1.27.1 security release | |||
| Resolved | None | T139570 API action=parse&prop=headhtml leaks current user and their tokens to third-party sites when used via JSONP |
This appears to be fixed by https://gerrit.wikimedia.org/r/#/c/297789/, which was already submitted to fix T139565.
[17:27:28] <logmsgbot> !log dereckson@tin Synchronized php-1.28.0-wmf.9/includes/api/ApiParse.php: API: Generate head items in the context of the given title (T139565) (duration: 00m 30s)
I'll leave it to someone from Security-Team to mark this as resolved.
This is worse than just a data leak (Vuln-Infoleak). The returned data (testing on my local wiki, before the patch) included the mw.user.tokens.set call with the CSRF token, so this essentially allowed for bypassing CSRF protection in almost all forms across the wiki.