Page MenuHomePhabricator

Backslash-escaped comments allow CSS injection vulnerability
Closed, ResolvedPublic


Wikipedia user Suffusion of Yellow discovered a CSS injection vulnerability, which occurs when CSS comments /* ... */ are escaped with backslashes: \2f\2a ... \2a\2f. The bug is due to an error in the CSS escape sequence normalisation code which we introduced to fix bug 23687.

As with any CSS injection vulnerability, the impact is complete account compromise (XSS) for Internet Explorer users, and possible privacy loss due to arbitrary remote image embedding for users of other browsers.

Version: 1.16.x
Severity: normal



Event Timeline

bzimport raised the priority of this task from to Medium.Nov 21 2014, 11:35 PM
bzimport added a project: MediaWiki-Parser.
bzimport set Reference to bz28450.
bzimport added a subscriber: Unknown Object (MLST).
tstarling created this task.Apr 7 2011, 4:33 AM

Was fixed in r85856

Basic test added with r100584