Page MenuHomePhabricator

CVE-2024-40612: BlueLL skin: stored XSS via MediaWiki:Sidebar
Closed, ResolvedPublicSecurity

Description

Top-level menu entries from MediaWiki:Sidebar are not properly escaped in the BlueLL skin (Lingua-Libre), resulting in classic stored XSS. The output of Sanitizer::escapeIdForAttribute is not HTML-safe, but the skin incorrectly assumes it is.

Minimal test case:

  1. As an (interface) administrator or other similarly privileged (editinterface) user, create a top level menu entry "named" "><script>alert('XSS')</script>< in MediaWiki:Sidebar
  2. Load a page with the BlueLL skin

Expected result:
No alert.

Actual result:
The alert runs.

Proposed & tested patch:

diff --git a/BlueLL.skin.php b/BlueLL.skin.php
index 71804c2..3fc9d78 100755
--- a/BlueLL.skin.php
+++ b/BlueLL.skin.php
@@ -86,7 +86,7 @@ class BlueLLTemplate extends BaseTemplate {
 
                                        <div id="top-bar-bottom-menu">
                                                <?php foreach ( $this->getSidebar() as $boxName => $box ) { if ( $box['header'] != wfMessage( 'toolbox' )->text() && $box['id'] != 'p-lang'  ) { ?>
-                                                       <ul id="<?php echo Sanitizer::escapeIdForAttribute( $box['id'] ) ?>"<?php echo Linker::tooltip( $box['id'] ) ?>>
+                                                       <ul id="<?php echo htmlspecialchars( Sanitizer::escapeIdForAttribute( $box['id'] ), ENT_QUOTES ) ?>"<?php echo Linker::tooltip( $box['id'] ) ?>>
                                                                <?php if ( is_array( $box['content'] ) ) { ?>
                                                                <?php foreach ( $box['content'] as $key => $item ) { echo $this->makeListItem( $key, $item ); } ?>
                                                                <?php } } ?>

Event Timeline

sbassett subscribed.

Since this skin isn't deployed or bundled, the proposed patch can go through gerrit at any time. It will be (re)announced via the next supplemental security release: T361321.

mmartorana renamed this task from BlueLL skin: stored XSS via MediaWiki:Sidebar to CVE-2024-40612: BlueLL skin: stored XSS via MediaWiki:Sidebar.Jul 8 2024, 5:37 PM
mmartorana changed the visibility from "Custom Policy" to "Public (No Login Required)".