Security researcher mghack discovered a CSS injection vulnerability. Incorrect parsing of CSS comments allows dangerous tokens such as expression() and url() to be passed through to the browser.

The vulnerability affects all previous versions of MediaWiki. A fix will be released shortly in MediaWiki 1.16.2. If patches are available for earlier major versions, it will be noted in a comment below.

Our fix involves:

• A patch to StringUtils::delimiterReplaceCallback() which fixes the logic error.
• A patch to Sanitizer::checkCss() which removes any remaining comment-start tokens, thus preventing any possible confusion over their interpretation.

Either of these patches would have fixed the problem alone.

This vulnerability was originally reported to the Mozilla Security Group and has been assigned CVE-2011-0047.

Version: 1.16.x
Severity: critical