Page MenuHomePhabricator

CVE-2024-40600: Metrolook skin: stored XSS via MediaWiki:Sidebar
Closed, ResolvedPublicSecurity

Description

Top-level menu entries from MediaWiki:Sidebar are not properly escaped in the Metrolook skin, resulting in classic stored XSS. The output of Sanitizer::escapeIdForAttribute is not HTML-safe, but the skin incorrectly assumes it is.

Minimal test case:

  1. As an (interface) administrator or other similarly privileged (editinterface) user, create a top level menu entry "named" "><script>alert('XSS')</script> in MediaWiki:Sidebar
  2. Load a page with the Metrolook skin

Expected result:
No alert.

Actual result:
The alertruns.

Proposed & tested patch:

diff --git a/MetrolookTemplate.php b/MetrolookTemplate.php
index 533b557..f4a3119 100644
--- a/MetrolookTemplate.php
+++ b/MetrolookTemplate.php
@@ -596,12 +596,12 @@ class MetrolookTemplate extends BaseTemplate {
                $labelId = Sanitizer::escapeIdForAttribute( "p-$name-label" );
                ?>
                <div class="portal" role="navigation" id='<?php
-               echo Sanitizer::escapeIdForAttribute( "p-$name" )
+               echo htmlspecialchars( Sanitizer::escapeIdForAttribute( "p-$name" ), ENT_QUOTES )
                ?>'<?php
                // If it isn't escaped, phan complains; if it _is_ escaped, phan still complains :^)
                // @phan-suppress-next-line SecurityCheck-DoubleEscaped
                echo htmlspecialchars( Linker::tooltip( 'p-' . $name ), ENT_QUOTES )
-               ?> aria-labelledby='<?php echo $labelId ?>'>
+               ?> aria-labelledby='<?php echo htmlspecialchars( $labelId, ENT_QUOTES ) ?>'>
                        <h5<?php $this->html( 'userlangattributes' ) ?> id='<?php echo $labelId ?>'><?php
                                echo htmlspecialchars( $msgObj->exists() ? $msgObj->text() : $msg );
                                ?></h5>

Notes about the patch:

  1. I tested it against edb0029fe4cbd8211c2be1d6a67b27425ad41e34 since it's the last 1.39-compatible version of the skin; it doesn't matter really since the bug is still present in master
  2. Only the first htmlspecialchars call added in the patch is needed to fix the security bug here; the second one merely prevents some garbage HTML being output. As you can see if you test it out, the alert regardless initially, prior to applying the patch, runs only once, not twice.

Event Timeline

Thank you for reporting! Would you mind doing the patch on Gerrit and I’ll +2 it as soon as you’ve done it please?

Thank you for reporting! Would you mind doing the patch on Gerrit and I’ll +2 it as soon as you’ve done it please?

Done now as https://gerrit.wikimedia.org/r/1015651 ; I added one more htmlspecialchars to that patch as opposed to the one posted here to clean up the HTML a tad bit (but again, only one of those calls is strictly "needed" to make the alert go away).

I've merged it and back ported it to all the stable releases up to 1.39 (so 1.41 & 1.40)

Paladox assigned this task to ashley.

Closing as resolved. I'm not sure what the process is for opening the task to public? Is it once all those changes were merged that it can?

Bawolff changed the visibility from "Custom Policy" to "Public (No Login Required)".Apr 3 2024, 9:02 PM
Bawolff changed the edit policy from "Custom Policy" to "All Users".
sbassett triaged this task as Medium priority.Apr 3 2024, 9:11 PM
sbassett moved this task from Incoming to Our Part Is Done on the Security-Team board.
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed Risk Rating from N/A to Medium.
mmartorana renamed this task from Metrolook skin: stored XSS via MediaWiki:Sidebar to CVE-2024-40600: Metrolook skin: stored XSS via MediaWiki:Sidebar.Jul 8 2024, 5:37 PM