CSS injection vulnerability (comment stripping)
Closed, ResolvedPublic

Description

Security researcher mghack discovered a CSS injection vulnerability. Incorrect parsing of CSS comments allows dangerous tokens such as expression() and url() to be passed through to the browser.

The vulnerability affects all previous versions of MediaWiki. A fix will be released shortly in MediaWiki 1.16.2. If patches are available for earlier major versions, it will be noted in a comment below.

Our fix involves:

  • A patch to StringUtils::delimiterReplaceCallback() which fixes the logic error.
  • A patch to Sanitizer::checkCss() which removes any remaining comment-start tokens, thus preventing any possible confusion over their interpretation.

Either of these patches would have fixed the problem alone.

This vulnerability was originally reported to the Mozilla Security Group and has been assigned CVE-2011-0047.


Version: 1.16.x
Severity: critical

Details

Reference
bz27093
bzimport added a subscriber: Unknown Object (MLST).
bzimport set Reference to bz27093.

Fixed in r81332

Since CodeReview only tags forward and not backwards with common "bug #" in the commit message, also naming the following revision in which it was fixed in trunk:

r81330 trunk
r81331 1.17
r81332 1.16
r 81333 1.15

Add Comment