Page MenuHomePhabricator
Create Task
Maniphest T297543

CVE-2022-28202: Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete
Closed, ResolvedPublicSecurity
Actions

Description

List of steps to reproduce (step by step, including full links if applicable):

  • Be sure your wiki has files uploaded (non-pdfs)
  • Go to [[MediaWiki:Widthheight]] and append "<script>alert('XSS widthheight');</script>"
  • Go to index.php?title=Special:NewFiles&limit=2 and you will get the alerts

This is from ImageHandler::getDimensionsString and also includes "widthheightpage" for pdfs.
It affects all gallery which shows dimensions, that is not true for parser/wikitext.
The default depends on $wgGalleryOptions.
Categories with files are affected
Special:Uncategorizedimages and Special:Unusedimages and Special:Mostimages are affected.

A second case:

  • Log in as sysop
  • Go to Special:ListFiles and select a file with a 2 or higher in the Versions column
  • In the file history click "(change visibility)" and you will get the alert.

For the second case the escaped is also missing for message "nbytes" in RevDelFileItem::getHTML

What happens?:
javascript alerts are shown.

What should have happened instead?:
No javascript alert should be shown. The script tag must be presented as visible text.

Software version (if not a Wikimedia wiki), browser information, screenshots, other information, etc: current master

Details

Risk Rating
Low
Author Affiliation
Wikimedia Communities
ProjectBranchLines +/-Subject
mediawiki/coreREL1_36+5 -3SECURITY: properly escape output used within galleries and Special:RevisionDelete
mediawiki/coreREL1_35+5 -3SECURITY: properly escape output used within galleries and Special:RevisionDelete
mediawiki/coreREL1_37+5 -3SECURITY: properly escape output used within galleries and Special:RevisionDelete
mediawiki/coremaster+5 -3SECURITY: properly escape output used within galleries and Special:RevisionDelete
Customize query in gerrit

Related Objects
Search...

Event Timeline

Umherirrender created this task.Dec 11 2021, 2:45 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 11 2021, 2:46 PM
Umherirrender added a comment.Dec 11 2021, 2:57 PM

Only priviliged user can edit messages, but the use of Special:RevisionDelete also affects oversights.

I am not sure if problems with message escaping should be public or better private like this. Feel free to change as needed.

Aklapper added projects: Vuln-XSS, MediaWiki-Special-pages.Dec 11 2021, 3:07 PM
Urbanecm added a subscriber: Urbanecm.Dec 12 2021, 3:11 PM

Thanks for filling the task. Definitely let's keep this private (at least for now) – this is an active vulnerability (although it requires sysop rights to exploit).

sbassett moved this task from Incoming to Watching on the Security-Team board.Dec 13 2021, 4:55 PM
sbassett added a project: SecTeam-Processed.
matmarex added a subscriber: matmarex.Dec 20 2021, 3:50 PM

We've resolved many issues like this in public in the past (recent examples:  1   2 ).

I think it's much more practical, and not very risky, to resolve them in public. Or if there's a good reason not to do that, please let me know and I'll keep similar issues private in the future too.

sbassett added a subscriber: sbassett.Dec 20 2021, 10:19 PM

This should just be a simple s/text/escaped/ here and here, correct?

In T297543#7580577, @matmarex wrote:

I think it's much more practical, and not very risky, to resolve them in public. Or if there's a good reason not to do that, please let me know and I'll keep similar issues private in the future too.

I think the Security-Team is fine rating many of these msg issues (including this issue) as low risk if a patch can go through gerrit on a Monday just prior to the train cut.

Umherirrender added a comment.Dec 28 2021, 12:14 PM
In T297543#7581457, @sbassett wrote:

This should just be a simple s/text/escaped/ here and here, correct?

In T297543#7580577, @matmarex wrote:

I think it's much more practical, and not very risky, to resolve them in public. Or if there's a good reason not to do that, please let me know and I'll keep similar issues private in the future too.

I think the Security-Team is fine rating many of these msg issues (including this issue) as low risk if a patch can go through gerrit on a Monday just prior to the train cut.

The return value of ImageHandler::getDimensionsString is escaped by the caller (at least in ImageHistoryList) and should be wrapped with htmlspecialchars in the Gallery here

The second part in RevDelFileItem is okay with /text/escaped/ replace.

sbassett added a project: Patch-For-Review.Jan 5 2022, 10:53 PM

First attempt at a patch per @Umherirrender's advice above. Per my previous comment, this can be sent up and merged via gerrit next Monday if it looks decent.

01-T297543.patch1 KBDownload

Umherirrender added a comment.Jan 8 2022, 11:45 AM
In T297543#7600206, @sbassett wrote:

First attempt at a patch per @Umherirrender's advice above. Per my previous comment, this can be sent up and merged via gerrit next Monday if it looks decent.

01-T297543.patch1 KBDownload

That works and looks very good. +2

sbassett added a subscriber: gerritbot.Jan 10 2022, 8:09 PM
gerritbot added a comment.Jan 10 2022, 8:21 PM

Change 752728 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/core@master] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/752728

gerritbot added a comment.Jan 10 2022, 9:02 PM

Change 752728 merged by jenkins-bot:

[mediawiki/core@master] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/752728

gerritbot added a comment.Jan 10 2022, 9:27 PM

Change 752285 had a related patch set uploaded (by SBassett; author: SBassett):

[mediawiki/core@REL1_37] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/752285

gerritbot added a comment.Jan 10 2022, 9:53 PM

Change 752285 merged by jenkins-bot:

[mediawiki/core@REL1_37] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/752285

Jdforrester-WMF added projects: MW-1.37-notes, MW-1.38-notes (1.38.0-wmf.17; 2022-01-10).Jan 10 2022, 11:36 PM
gerritbot added a comment.Jan 12 2022, 7:45 PM

Change 753496 had a related patch set uploaded (by Umherirrender; author: SBassett):

[mediawiki/core@REL1_36] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/753496

gerritbot added a comment.Jan 12 2022, 7:46 PM

Change 753497 had a related patch set uploaded (by Umherirrender; author: SBassett):

[mediawiki/core@REL1_35] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/753497

Umherirrender triaged this task as Medium priority.Jan 12 2022, 8:02 PM
Umherirrender edited projects, added MW-1.36-notes, MW-1.35-notes; removed Patch-For-Review.
gerritbot added a comment.Jan 12 2022, 8:13 PM

Change 753497 merged by jenkins-bot:

[mediawiki/core@REL1_35] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/753497

gerritbot added a comment.Jan 12 2022, 8:15 PM

Change 753496 merged by jenkins-bot:

[mediawiki/core@REL1_36] SECURITY: properly escape output used within galleries and Special:RevisionDelete

https://gerrit.wikimedia.org/r/753496

sbassett closed this task as Resolved.Jan 24 2022, 9:48 PM
sbassett claimed this task.
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.
sbassett added a parent task: T2212: Some MediaWiki: messages not safe in HTML (tracking).
sbassett moved this task from Watching to Our Part Is Done on the Security-Team board.
sbassett added a project: user-sbassett.
sbassett moved this task from Backlog to Done on the user-sbassett board.Jan 24 2022, 9:51 PM
Reedy added a parent task: T297830: Tracking bug for MediaWiki 1.35.6/1.36.4/1.37.2.Mar 20 2022, 2:51 PM
Reedy mentioned this in T297830: Tracking bug for MediaWiki 1.35.6/1.36.4/1.37.2.Mar 20 2022, 3:23 PM
Reedy renamed this task from Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete to CVE-2022-: Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete.Mar 28 2022, 1:52 PM
Reedy mentioned this in T297831: Obtain CVEs for 1.35.6/1.36.4/1.37.2 security releases.
Reedy renamed this task from CVE-2022-: Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete to CVE-2022-28202: Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete.Mar 30 2022, 6:02 PM
Content licensed under Creative Commons Attribution-ShareAlike 3.0 (CC-BY-SA) unless otherwise noted; code licensed under GNU General Public License (GPL) or other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL