Page MenuHomePhabricator
Create Task
Maniphest T399662

CVE-2025-62698: Stored XSS through system messages in ExternalGuidance
Closed, ResolvedPublicSecurity
Actions

Assigned To
SomeRandomDeveloper
Authored By
SomeRandomDeveloper
Jul 15 2025, 11:06 PM
Project Tags
Referenced Files
F66723728: T399662-REL1_39.patch
Oct 3 2025, 3:55 PM
F66723725: T399662-REL1_43.patch
Oct 3 2025, 3:55 PM
F64683710: T399662.patch
Jul 15 2025, 11:09 PM
F64682223: image.png
Jul 15 2025, 11:06 PM
F64682132: image.png
Jul 15 2025, 11:06 PM
F64682084: image.png
Jul 15 2025, 11:06 PM
Subscribers
Aklapper
gerritbot
Mstyles
sbassett
SomeRandomDeveloper

Description

In the ExternalGuidance extension, the externalguidance-machine-translation-heading and externalguidance-machine-translation-contribute system messages are inserted as HTML without proper sanitization.

Reproduction

  1. Install ExternalGuidance
  2. Go to /w/index.php?title=Main_Page&uselang=x-xss
  3. Run the following JS in the browser console (there is barely any documentation on how the extension works, so I just used this to manually load the module with minimal configuration):
mw.loader.using( [ 'mw.externalguidance' ] ).then( ( req ) => {
	const ExternalGuidance = req( 'mw.externalguidance' );
	const eg = new ExternalGuidance( 'machine-translation', {service: 'Google', to: 'de'} );
	eg.init();
} );

image.png (420×156 px, 9 KB)

image.png (412×190 px, 15 KB)

image.png (555×583 px, 75 KB)

Cause

The result of mw.msg(), which returns messages unsanitized, is passed to .html(), which inserts the message contents as raw HTML:
https://gerrit.wikimedia.org/g/mediawiki/extensions/ExternalGuidance/+/7584a17bb7f10f4622caf070a075d9daf4e24c62/modules/mw.externalguidance/core.js#61
https://gerrit.wikimedia.org/g/mediawiki/extensions/ExternalGuidance/+/7584a17bb7f10f4622caf070a075d9daf4e24c62/modules/mw.externalguidance/core.js#111

Additional information

Details

Risk Rating
Low
Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: Insert messages using .text() instead of .html()SBassettmediawiki/extensions/ExternalGuidanceREL1_43+2 -2
SECURITY: Insert messages using .text() instead of .html()SBassettmediawiki/extensions/ExternalGuidanceREL1_39+2 -2
SECURITY: Insert messages using .text() instead of .html()Reedymediawiki/extensions/ExternalGuidanceREL1_44+2 -2
SECURITY: Insert messages using .text() instead of .html()Reedymediawiki/extensions/ExternalGuidancemaster+2 -2
SECURITY: Insert messages using .text() instead of .html()Reedymediawiki/extensions/ExternalGuidanceREL1_43+266 -0
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedSecuritySomeRandomDeveloperT399662 CVE-2025-62698: Stored XSS through system messages in ExternalGuidance

Event Timeline

SomeRandomDeveloper created this task.Jul 15 2025, 11:06 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJul 15 2025, 11:06 PM
SomeRandomDeveloper claimed this task.Jul 15 2025, 11:06 PM
SomeRandomDeveloper added projects: ExternalGuidance, Vuln-XSS.
SomeRandomDeveloper added a parent task: Restricted Task.
SomeRandomDeveloper added a comment.Jul 15 2025, 11:09 PM

Patch:

T399662.patch1 KBDownload

SomeRandomDeveloper mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Jul 16 2025, 1:54 PM
sbassett moved this task from Incoming to Security Patch To Deploy on the Security-Team board.Jul 16 2025, 1:58 PM
sbassett added a project: SecTeam-Processed.
sbassett subscribed.
In T399662#11007243, @SomeRandomDeveloper wrote:

Patch:

T399662.patch1 KBDownload

CR+1, LGTM. This can likely get deployed during next Monday's security window (2025-07-21).

sbassett changed the task status from Open to In Progress.Jul 16 2025, 1:59 PM
sbassett triaged this task as Low priority.
sbassett changed Risk Rating from N/A to Low.
Mstyles subscribed.Jul 21 2025, 9:40 PM
In T399662#11007243, @SomeRandomDeveloper wrote:

Patch:

T399662.patch1 KBDownload

deployed

sbassett moved this task from Security Patch To Deploy to Watching on the Security-Team board.Jul 22 2025, 9:27 PM
Reedy added a subscriber: gerritbot.Sep 17 2025, 3:18 PM
gerritbot added a comment.Sep 17 2025, 3:19 PM

Change #1189231 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/extensions/ExternalGuidance@master] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1189231

gerritbot added a project: Patch-For-Review.Sep 17 2025, 3:19 PM
gerritbot added a comment.Sep 17 2025, 3:49 PM

Change #1189231 merged by jenkins-bot:

[mediawiki/extensions/ExternalGuidance@master] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1189231

gerritbot added a comment.Sep 17 2025, 3:49 PM

Change #1189244 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/extensions/ExternalGuidance@REL1_44] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1189244

gerritbot added a comment.Sep 17 2025, 3:49 PM

Change #1189246 had a related patch set uploaded (by Reedy; author: SomeRandomDeveloper):

[mediawiki/extensions/ExternalGuidance@REL1_43] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1189246

gerritbot added a comment.Sep 17 2025, 3:50 PM

Change #1189246 abandoned by Reedy:

[mediawiki/extensions/ExternalGuidance@REL1_43] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1189246

gerritbot added a comment.Sep 17 2025, 4:04 PM

Change #1189244 merged by jenkins-bot:

[mediawiki/extensions/ExternalGuidance@REL1_44] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1189244

SomeRandomDeveloper added a comment.Oct 3 2025, 3:55 PM

This needs to be backported to REL1_43 and REL1_39:

T399662-REL1_43.patch1 KBDownload

T399662-REL1_39.patch1 KBDownload

gerritbot added a comment.Oct 3 2025, 9:49 PM

Change #1193509 had a related patch set uploaded (by SBassett; author: SomeRandomDeveloper):

[mediawiki/extensions/ExternalGuidance@REL1_43] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1193509

gerritbot added a comment.Oct 3 2025, 9:50 PM

Change #1193510 had a related patch set uploaded (by SBassett; author: SomeRandomDeveloper):

[mediawiki/extensions/ExternalGuidance@REL1_39] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1193510

gerritbot added a comment.Oct 3 2025, 9:56 PM

Change #1193510 merged by jenkins-bot:

[mediawiki/extensions/ExternalGuidance@REL1_39] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1193510

gerritbot added a comment.Oct 3 2025, 10:41 PM

Change #1193509 merged by jenkins-bot:

[mediawiki/extensions/ExternalGuidance@REL1_43] SECURITY: Insert messages using .text() instead of .html()

https://gerrit.wikimedia.org/r/1193509

SomeRandomDeveloper closed this task as Resolved.Oct 3 2025, 10:53 PM
SomeRandomDeveloper removed a project: Patch-For-Review.
Mstyles renamed this task from Stored XSS through system messages in ExternalGuidance to CVE-2025-62698: Stored XSS through system messages in ExternalGuidance.Oct 21 2025, 5:53 AM
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits