Page MenuHomePhabricator
Create Task
Maniphest T402002

CVE-2025-62664: Stored XSS through a system message in ImageRating
Closed, ResolvedPublicSecurity
Actions

Description

The imagerating-category system message is inserted as HTML by the ImageRating extension, allowing for stored XSS.

Reproduction

  1. Enable VoteNY and ImageRating
  2. Upload a file
  3. Add <vote type=1 /> to the file page
  4. Vote for the file
  5. Make sure $wgUseXssLanguage is set to true
  6. Go to /wiki/Special:ImageRating?uselang=x-xss
  7. Enter any valid category name (doesn't have to exist) into the textbox next to the image you just rated and click the button under the text box

image.png (563×376 px, 40 KB)

Cause

The result of mw.msg(), which returns system messages unescaped, is passed to the .html() function of jQuery, causing the message contents to be inserted as raw HTML.

https://github.com/wikimedia/mediawiki-extensions-ImageRating/blob/4196049eae8c6bf93b725db847beb82fbc2a19fb/resources/js/ImageRating.js#L39

Additional information

  • MediaWiki: 1.45.0-alpha (16de043)
  • VoteNY: d9c13f3
  • ImageRating: 4196049

Details

Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: Insert system messages as text instead of HTMLSomeRandomDevelopermediawiki/extensions/ImageRatingmaster+1 -1
SECURITY: Insert system messages as text instead of HTMLSomeRandomDevelopermediawiki/extensions/ImageRatingREL1_44+1 -1
SECURITY: Insert system messages as text instead of HTMLSomeRandomDevelopermediawiki/extensions/ImageRatingREL1_43+1 -1
SECURITY: Insert system messages as text instead of HTMLSomeRandomDevelopermediawiki/extensions/ImageRatingREL1_39+1 -1
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedSecuritySomeRandomDeveloperT402002 CVE-2025-62664: Stored XSS through a system message in ImageRating

Event Timeline

SomeRandomDeveloper created this task.Aug 15 2025, 11:17 AM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 15 2025, 11:17 AM
SomeRandomDeveloper claimed this task.Aug 15 2025, 11:17 AM
SomeRandomDeveloper added a parent task: Restricted Task.
SomeRandomDeveloper added projects: affects-Miraheze, ImageRating, Vuln-XSS.
SomeRandomDeveloper added a subscriber: ashley.
SomeRandomDeveloper added a comment.Aug 15 2025, 11:23 AM

Patch:

T402002.patch1 KBDownload

(I was not able to test this due to the aforementioned issues. However, the message doesn't seem to include any HTML which would have to be converted to wikitext and parsed, so just using .text() should be sufficient here)

SomeRandomDeveloper mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Aug 15 2025, 11:23 AM
ashley added a comment.Aug 15 2025, 11:30 AM
In T402002#11089349, @SomeRandomDeveloper wrote:

Patch:

LGTM, nice catch! 👍

I wonder in how many other extensions you can find the same flaw... 🤔

SomeRandomDeveloper added a subscriber: gerritbot.Aug 15 2025, 11:31 AM
In T402002#11089355, @ashley wrote:
In T402002#11089349, @SomeRandomDeveloper wrote:

Patch:

LGTM, nice catch! 👍

Would you be able to +2 it if I uploaded it to gerrit shortly?

ashley added a comment.Aug 15 2025, 11:35 AM
In T402002#11089361, @SomeRandomDeveloper wrote:
In T402002#11089355, @ashley wrote:
In T402002#11089349, @SomeRandomDeveloper wrote:

Patch:

LGTM, nice catch! 👍

Would you be able to +2 it if I uploaded it to gerrit shortly?

Sure, go ahead, please!

gerritbot added a comment.Aug 15 2025, 11:36 AM

Change #1179113 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/ImageRating@master] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179113

gerritbot added a project: Patch-For-Review.Aug 15 2025, 11:36 AM

Change #1179114 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/ImageRating@REL1_44] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179114

gerritbot added a comment.Aug 15 2025, 11:36 AM

Change #1179115 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/ImageRating@REL1_43] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179115

gerritbot added a comment.Aug 15 2025, 11:37 AM

Change #1179116 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/ImageRating@REL1_39] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179116

gerritbot added a comment.Aug 15 2025, 11:40 AM

Change #1179116 merged by jenkins-bot:

[mediawiki/extensions/ImageRating@REL1_39] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179116

gerritbot added a comment.Aug 15 2025, 11:40 AM

Change #1179115 merged by jenkins-bot:

[mediawiki/extensions/ImageRating@REL1_43] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179115

gerritbot added a comment.Aug 15 2025, 11:41 AM

Change #1179114 merged by jenkins-bot:

[mediawiki/extensions/ImageRating@REL1_44] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179114

SomeRandomDeveloper updated the task description. (Show Details)Aug 15 2025, 11:55 AM

Thanks for merging! I added reproduction steps based on the steps suggested in T401998#11089373, and was able to reproduce the vulnerability on the commit before my patch, and could no longer reproduce it with my patch.

SomeRandomDeveloper updated the task description. (Show Details)Aug 15 2025, 11:58 AM
SomeRandomDeveloper mentioned this in rEIMRe996b7afe60d: SECURITY: Insert system messages as text instead of HTML.Aug 15 2025, 12:01 PM
SomeRandomDeveloper mentioned this in rEIMRe748f0adc941: SECURITY: Insert system messages as text instead of HTML.
SomeRandomDeveloper mentioned this in rEIMRb01d5bfc5e34: SECURITY: Insert system messages as text instead of HTML.
gerritbot added a comment.Aug 15 2025, 12:04 PM

Change #1179113 merged by jenkins-bot:

[mediawiki/extensions/ImageRating@master] SECURITY: Insert system messages as text instead of HTML

https://gerrit.wikimedia.org/r/1179113

SomeRandomDeveloper mentioned this in rEIMR9f1935942d81: SECURITY: Insert system messages as text instead of HTML.Aug 15 2025, 12:05 PM
sbassett changed the task status from Open to In Progress.Aug 18 2025, 4:31 PM
sbassett triaged this task as Low priority.
sbassett moved this task from Incoming to Watching on the Security-Team board.
sbassett edited projects, added: SecTeam-Processed; removed: Patch-For-Review.
sbassett subscribed.

Thanks!

SomeRandomDeveloper closed this task as Resolved.Sep 24 2025, 11:06 PM

Closing as the fix was merged and backported.

Mstyles renamed this task from Stored XSS through a system message in ImageRating to CVE-2025-62664: Stored XSS through a system message in ImageRating.Oct 18 2025, 4:58 AM
Mstyles changed the visibility from "Custom Policy" to "Public (No Login Required)".
Mstyles changed the edit policy from "Custom Policy" to "All Users".
Maintenance_bot added a project: Social-Tools.Oct 18 2025, 5:29 AM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits