XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Bawolff
	Oct 18 2017, 5:15 AM

Description

Unclear how exploitable this actually is.

Basic issue, in "includes/MWException.php" line 112, the internalerror-fatal-exception uses ->text() instead of ->escaped(). Furthermore, one of the parameters (the url) is semi-user controlled.

Set $wgShowExceptionDetails = false; (the default)
Make a page that somehow triggers a MWException
append &uselang=qqx to the url so all parameters are shown
append &foo=<script>alert(1)</script>
Maybe you get an xss. This will depend on user-agent. Firefox, chrome and safari (in my limitted testing) seems to always percent encode < and > in the HTTP request. curl on the other hand does not. I have no idea if there exists generally used browsers which are vulnerable.

I guess we should treat this as an actual xss just in case?

Details

Subject	Repo	Branch	Lines +/-
SECURITY: Escape internal error message	mediawiki/core	wmf/1.31.0-wmf.8	+18 -15
SECURITY: Escape internal error message	mediawiki/core	master	+18 -15
SECURITY: Escape internal error message	mediawiki/core	fundraising/REL1_27	+11 -8
SECURITY: Escape internal error message	mediawiki/core	REL1_27	+11 -7
SECURITY: Escape internal error message	mediawiki/core	REL1_30	+20 -14
SECURITY: Escape internal error message	mediawiki/core	REL1_29	+11 -7
SECURITY: Escape internal error message	mediawiki/core	REL1_28	+11 -7

Customize query in gerrit

Related Objects
Search...

Status	Assigned	Task
Resolved	Reedy	T180272 Release MediaWiki 1.27.4/1.28.3/1.29.2
Resolved	• demon	T169127 Release MediaWiki 1.30
Resolved	Reedy	T168823 Tracking bug for 1.27.4/1.28.3/1.29.2 security releases
Resolved	Bawolff	T178451 XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping

Event Timeline

Bawolff created this task.Oct 18 2017, 5:15 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptOct 18 2017, 5:15 AM

Bawolff added a project: Vuln-XSS.Oct 18 2017, 5:17 AM

T178451.patch1 KBDownload

Missed a case, new patch

T178451 - v22 KBDownload

Bawolff added a parent task: T168823: Tracking bug for 1.27.4/1.28.3/1.29.2 security releases.Oct 18 2017, 5:12 PM

• dpatrick triaged this task as Medium priority.Oct 18 2017, 5:19 PM

Patch LGTM, +2. Relatedly, I think it's confusing that MWException::msg() returns a non-escaped string instead of a Message object.

Just as an aside, rfc3986 doesn't list "<" or ">" as reserved characters, so arguably curl's behaviour is correct.

Bawolff moved this task from Backlog / Other to Patch pending deployment on the acl*security board.Oct 18 2017, 5:59 PM

Reedy renamed this task from XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping. to XSS when $wgShowExceptionDetails=false and browser sends non-standard url escaping.Nov 2 2017, 7:41 PM

Reedy mentioned this in T168823: Tracking bug for 1.27.4/1.28.3/1.29.2 security releases.

0001-T178451-REL1_29.patch3 KBDownload

0001-T178451-REL1_30.patch2 KBDownload

0001-T178451-master.patch2 KBDownload

REL1_27 doesn't have MWExceptionRenderer, so needs a bit more work

In T178451#3730709, @Reedy wrote:

REL1_27 doesn't have MWExceptionRenderer, so needs a bit more work

Or, even, less work. Change doesn't need applying to that file if it doesn't exist.

Fixed RELEASE-NOTES too

0001-T178451-REL1_27.patch2 KBDownload

0001-T178451-REL1_29.patch1 KBDownload

0001-T178451-REL1_30.patch3 KBDownload

Reedy assigned this task to Bawolff.Nov 2 2017, 10:42 PM

Reedy mentioned this in T179609: Obtain CVE's for 1.27.4/1.29.2 security releases.Nov 2 2017, 10:49 PM

0001-T178451-REL1_27.patch2 KBDownload

rebased for patches merged to branch...

I deployed the patch on wmf wikis.

[22:34] bawolff !log Deploy patch for T178451

Bawolff moved this task from Patch pending deployment to Pending deployment / release on the acl*security board.Nov 8 2017, 5:46 PM

Reedy added a comment.Nov 10 2017, 10:20 PM

This comment was removed by Reedy.

0001-T178451-REL1_29.patch2 KBDownload

0001-T178451-REL1_28.patch2 KBDownload

This is CVE-2017-8808

Closes as resolved (due to patches existing, and backports having been made), for ease of tracking in parent bugs

Reedy changed the visibility from "Custom Policy" to "Public (No Login Required)".Nov 15 2017, 12:02 AM

Change 391417 had a related patch set uploaded (by Reedy; owner: Brian Wolff):
[mediawiki/core@REL1_30] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391417

Change 391417 merged by Reedy:
[mediawiki/core@REL1_30] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391417

Change 391433 had a related patch set uploaded (by Ejegg; owner: Ejegg):
[mediawiki/core@fundraising/REL1_27] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391433

Change 391433 merged by Ejegg:
[mediawiki/core@fundraising/REL1_27] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391433

Change 391447 had a related patch set uploaded (by Reedy; owner: Brian Wolff):
[mediawiki/core@master] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391447

ReleaseTaggerBot added projects: MW-1.30-release-notes, MW-1.29-release-notes.Nov 15 2017, 1:01 AM

Change 391447 merged by jenkins-bot:
[mediawiki/core@master] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391447

ReleaseTaggerBot added a project: MW-1.31-release-notes (WMF-deploy-2017-11-28 (1.31.0-wmf.10)).Nov 15 2017, 2:00 AM

Change 391730 had a related patch set uploaded (by Chad; owner: Brian Wolff):
[mediawiki/core@wmf/1.31.0-wmf.8] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391730

Change 391730 merged by jenkins-bot:
[mediawiki/core@wmf/1.31.0-wmf.8] SECURITY: Escape internal error message

https://gerrit.wikimedia.org/r/391730

ReleaseTaggerBot edited projects, added MW-1.31-release-notes (WMF-deploy-2017-11-14 (1.31.0-wmf.8)); removed MW-1.31-release-notes (WMF-deploy-2017-11-28 (1.31.0-wmf.10)).Nov 16 2017, 1:00 AM

sbassett moved this task from Pending deployment / release to Done on the acl*security board.Sep 26 2019, 2:32 PM

• chasemp added a project: Security.Feb 10 2020, 10:58 PM

• chasemp removed a project: acl*security.Feb 20 2020, 8:17 PM