The pagetriage-new-page-feed-show-ip and pagetriage-new-page-feed-show-ip-not-found system messages are inserted as raw HTML by the PageTriage extension, allowing for stored XSS by inserting malicious HTML into the messages.

Reproduction steps for both vulnerabilities:

1. Install PageTriage
2. Install CheckUser
3. Add the following to your LocalSettings.php (not all might be required):

$wgGroupPermissions['sysop']['checkuser'] = true;
$wgGroupPermissions['sysop']['checkuser-log'] = true;
$wgGroupPermissions['sysop']['investigate'] = true;
$wgGroupPermissions['sysop']['checkuser-temporary-account-log'] = true;
$wgGroupPermissions['sysop']['checkuser-temporary-account-no-preference'] = true;

pagetriage-new-page-feed-show-ip

Reproduction

1. Edit MediaWiki:Pagetriage-new-page-feed-show-ip to <img src="" onerror="alert(1)">
2. In a private browser tab, create a new page using a temporary account
3. Go to Special:NewPagesFeed using an account with the sysop group

Cause

The unescaped system message is passed into jQuery's .append() function, which inserts it as raw HTML:

https://gerrit.wikimedia.org/g/mediawiki/extensions/PageTriage/+/2e47e4bb436c8438389352303f8946939fc85cb6/modules/ext.pageTriage.showIp/showIp.js#69

pagetriage-new-page-feed-show-ip-not-found

Reproduction

1. Add $wgCUDMaxAge = 1; to your LocalSettings.php so we can make CheckUser forget about the temporary account's IP later
2. Edit MediaWiki:Pagetriage-new-page-feed-show-ip-not-found to <img src="" onerror="alert(2)">
3. In a private browser tab, create a new page using a temporary account
4. Run the CheckUser:purgeOldData maintenance script (which should delete the IP of the temporary account)
5. Go to Special:NewPagesFeed using an account with the sysop group
6. Click on the "Show IP" link next to the name of the temporary account

Cause

The unescaped system message is passed into jQuery's .replaceWith() function, which inserts it as raw HTML:

https://gerrit.wikimedia.org/g/mediawiki/extensions/PageTriage/+/2e47e4bb436c8438389352303f8946939fc85cb6/modules/ext.pageTriage.showIp/showIp.js#80

Additional information

• MediaWiki: 1.45.0-alpha (81259da)
• CheckUser: 92d00e4
• PageTriage: 2e47e4b