CVE-2025-23080: XSSes in Special:BadgeView
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	BlankEclair
	Dec 1 2024, 1:46 PM

Description

The system messages ob-view-proof, ob-view-no-evidence, and ob-view-evidence are used unescaped: https://github.com/wikimedia/mediawiki-extensions-OpenBadges/blob/a8d210903f0f0df1d3aa630b020576acc1a5e716/includes/specials/BadgesPager.php#L101-L125

Screenshot of XSS:

Details

Author Affiliation: Wikimedia Communities

Subject	Repo	Branch	Lines +/-
SECURITY: Escape interface messages used in Special:BadgeView	mediawiki/extensions/OpenBadges	REL1_41	+3 -3
SECURITY: Escape interface messages used in Special:BadgeView	mediawiki/extensions/OpenBadges	REL1_43	+3 -3
SECURITY: Escape interface messages used in Special:BadgeView	mediawiki/extensions/OpenBadges	REL1_42	+3 -3
SECURITY: Escape interface messages used in Special:BadgeView	mediawiki/extensions/OpenBadges	master	+3 -3

Customize query in gerrit

Related Objects

Mentioned In: T375631: Write and send supplementary release announcement for extensions and skins with security patches (1.39.11/1.41.5/1.42.4)

Event Timeline

BlankEclair created this task.Dec 1 2024, 1:46 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptDec 1 2024, 1:46 PM

BlankEclair added projects: OpenBadges, Vuln-XSS.Dec 1 2024, 1:47 PM

BlankEclair added subscribers: Universal_Omega, Tfellows.

T381220.patch1 KBDownload

@BlankEclair you can put this patch through gerrit since it's low priority.

Mstyles mentioned this in T375631: Write and send supplementary release announcement for extensions and skins with security patches (1.39.11/1.41.5/1.42.4).Dec 2 2024, 5:26 PM

Mstyles added a subscriber: gerritbot.

Change #1101187 had a related patch set uploaded (by BlankEclair; author: BlankEclair):

[mediawiki/extensions/OpenBadges@master] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1101187

gerritbot added a project: Patch-For-Review.Dec 8 2024, 9:27 AM

Change #1101187 merged by jenkins-bot:

[mediawiki/extensions/OpenBadges@master] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1101187

Change #1101196 had a related patch set uploaded (by Paladox; author: BlankEclair):

[mediawiki/extensions/OpenBadges@REL1_43] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1101196

Change #1101198 had a related patch set uploaded (by Paladox; author: BlankEclair):

[mediawiki/extensions/OpenBadges@REL1_42] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1101198

Change #1101198 merged by jenkins-bot:

[mediawiki/extensions/OpenBadges@REL1_42] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1101198

Change #1101196 merged by jenkins-bot:

[mediawiki/extensions/OpenBadges@REL1_43] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1101196

BlankEclair closed this task as Resolved.Dec 9 2024, 1:37 PM

BlankEclair claimed this task.

BlankEclair removed a project: Patch-For-Review.

Change #1109742 had a related patch set uploaded (by Mmartorana; author: BlankEclair):

[mediawiki/extensions/OpenBadges@REL1_41] SECURITY: Escape interface messages used in Special:BadgeView

https://gerrit.wikimedia.org/r/1109742

gerritbot added a project: Patch-For-Review.Fri, Jan 10, 4:36 PM

mmartorana changed the visibility from "Custom Policy" to "Public (No Login Required)".Tue, Jan 14, 4:33 PM

mmartorana changed the edit policy from "Custom Policy" to "All Users".

mmartorana renamed this task from XSSes in Special:BadgeView to CVE-2025-23080: XSSes in Special:BadgeView.Tue, Jan 14, 7:19 PM

Change #1109742 merged by Paladox: