Page MenuHomePhabricator
Create Task
Maniphest T389590

CVE-2025-32070:XSSes in AJAXPoll
Closed, ResolvedPublicSecurity
Actions

Description

Source: https://gerrit.wikimedia.org/r/plugins/gitiles/mediawiki/extensions/AJAXPoll/+/6a7aa1b320d3e87e14288e2f889930ea2b98b055/includes/AJAXPoll.php#415
Reproduction steps:

  1. Set a vulnerable system message (such as ajaxpoll-no-vote-results-after-voting) to an XSS payload
  2. Render a <poll> that displays said message

Screenshot:

2025-03-21_17-46.png (1,680×837 px, 41 KB)

Details

Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: Escape various interface messagesBlankEclairmediawiki/extensions/AJAXPollREL1_42+11 -9
SECURITY: Escape various interface messagesBlankEclairmediawiki/extensions/AJAXPollREL1_39+11 -9
SECURITY: Escape various interface messagesBlankEclairmediawiki/extensions/AJAXPollREL1_43+11 -9
SECURITY: Escape various interface messagesBlankEclairmediawiki/extensions/AJAXPollmaster+11 -9
Customize query in gerrit

Related Objects

Event Timeline

BlankEclair created this task.Mar 21 2025, 6:49 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 21 2025, 6:49 AM
BlankEclair claimed this task.Mar 21 2025, 6:50 AM
BlankEclair added projects: AJAXPoll, Vuln-XSS.
BlankEclair added a subscriber: ashley.
BlankEclair added a comment.Mar 21 2025, 7:02 AM

T389590.patch2 KBDownload

BlankEclair added a subscriber: Universal_Omega.Mar 21 2025, 7:05 AM
BlankEclair added a project: Patch-For-Review.Mar 21 2025, 7:09 AM
BlankEclair added a subscriber: gerritbot.

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AJAXPoll/+/1130013

gerritbot added a comment.Mar 21 2025, 7:13 AM

Change #1130013 merged by jenkins-bot:

[mediawiki/extensions/AJAXPoll@master] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130013

BlankEclair removed a project: Patch-For-Review.Mar 21 2025, 7:15 AM
gerritbot added a comment.Mar 21 2025, 7:17 AM

Change #1130014 had a related patch set uploaded (by BlankEclair; author: BlankEclair):

[mediawiki/extensions/AJAXPoll@REL1_43] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130014

gerritbot added a project: Patch-For-Review.Mar 21 2025, 7:17 AM

Change #1130015 had a related patch set uploaded (by BlankEclair; author: BlankEclair):

[mediawiki/extensions/AJAXPoll@REL1_42] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130015

gerritbot added a comment.Mar 21 2025, 7:17 AM

Change #1130016 had a related patch set uploaded (by BlankEclair; author: BlankEclair):

[mediawiki/extensions/AJAXPoll@REL1_39] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130016

gerritbot added a comment.Mar 21 2025, 7:20 AM

Change #1130014 merged by jenkins-bot:

[mediawiki/extensions/AJAXPoll@REL1_43] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130014

gerritbot added a comment.Mar 21 2025, 7:20 AM

Change #1130016 merged by jenkins-bot:

[mediawiki/extensions/AJAXPoll@REL1_39] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130016

gerritbot added a comment.Mar 21 2025, 7:20 AM

Change #1130015 merged by jenkins-bot:

[mediawiki/extensions/AJAXPoll@REL1_42] SECURITY: Escape various interface messages

https://gerrit.wikimedia.org/r/1130015

BlankEclair removed a project: Patch-For-Review.Mar 21 2025, 7:21 AM
sbassett mentioned this in T382326: Write and send supplementary release announcement for extensions and skins with security patches (1.39.12/1.42.6/1.43.1).Mar 21 2025, 2:13 PM
• Jly closed this task as Resolved.Mar 24 2025, 4:10 PM
• Jly added a project: SecTeam-Processed.
Mstyles renamed this task from XSSes in AJAXPoll to CVE-2025-32070:XSSes in AJAXPoll.Apr 11 2025, 5:08 PM
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".
SomeRandomDeveloper mentioned this in T322481: AjaxPoll extension has i18n message XSS in several places.Jul 8 2026, 11:37 PM
sbassett merged a task: T322481: AjaxPoll extension has i18n message XSS in several places.Jul 9 2026, 2:41 PM
sbassett added subscribers: Apple502j, SomeRandomDeveloper, sbassett and 2 others.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits