CSS injection vulnerability (comment stripping)
Closed, ResolvedPublic

Description

Security researcher mghack discovered a CSS injection vulnerability. Incorrect parsing of CSS comments allows dangerous tokens such as expression() and url() to be passed through to the browser.

The vulnerability affects all previous versions of MediaWiki. A fix will be released shortly in MediaWiki 1.16.2. If patches are available for earlier major versions, it will be noted in a comment below.

Our fix involves:

  • A patch to StringUtils::delimiterReplaceCallback() which fixes the logic error.
  • A patch to Sanitizer::checkCss() which removes any remaining comment-start tokens, thus preventing any possible confusion over their interpretation.

Either of these patches would have fixed the problem alone.

This vulnerability was originally reported to the Mozilla Security Group and has been assigned CVE-2011-0047.


Version: 1.16.x
Severity: critical

bzimport added a project: MediaWiki-Parser.Via ConduitNov 21 2014, 11:22 PM
bzimport added a subscriber: wikibugs-l.
bzimport set Reference to bz27093.
tstarling created this task.Via LegacyFeb 1 2011, 10:11 PM
Platonides added a comment.Via ConduitFeb 2 2011, 6:19 PM

Fixed in r81332

Krinkle added a comment.Via ConduitFeb 2 2011, 6:23 PM

Since CodeReview only tags forward and not backwards with common "bug #" in the commit message, also naming the following revision in which it was fixed in trunk:

r81330 trunk
r81331 1.17
r81332 1.16
r 81333 1.15

Add Comment

Column Prototype
This is a very early prototype of a persistent column. It is not expected to work yet, and leaving it open will activate other new features which will break things. Press "\" (backslash) on your keyboard to close it now.