Page MenuHomePhabricator
Create Task
Maniphest T403093

CVE-2025-62652: Stored XSS in WebAuthn key name
Closed, ResolvedPublicSecurity
Actions

Description

  • With an account that doesn't have 2FA enabled, enable WebAuthn
  • When it prompts for the name of the key, enter oops<script>alert('xss')</script>
  • Finish the process and get redirected back to Special:AccountSecurity
  • An alert now pops up every time you visit Special:AccountSecurity

This probably isn't very exploitable, but we still shouldn't have this happen. It could also be a way that user scripts could wiggle their way onto Special:AccountSecurity (user scripts are disabled there, but this XSS could let them run code on that page), but that's also unlikely since completing the key setup process requires user interaction.

Details

Risk Rating
Medium
Author Affiliation
WMF Product
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: Escape key name in management UIReedymediawiki/extensions/WebAuthnREL1_39+2 -1
SECURITY: Escape key name in management UIReedymediawiki/extensions/WebAuthnREL1_43+2 -1
SECURITY: Escape key name in management UIReedymediawiki/extensions/WebAuthnREL1_44+2 -1
SECURITY: Escape key name in management UIReedymediawiki/extensions/WebAuthnmaster+2 -1
Customize query in gerrit

Related Objects

Event Timeline

Catrope created this task.Aug 27 2025, 4:35 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 27 2025, 4:35 PM
Catrope added a project: MediaWiki-extensions-OATHAuth.Aug 27 2025, 4:36 PM

0001-SECURITY-Escape-key-name-in-management-UI.patch1 KBDownload

sbassett subscribed.Aug 27 2025, 4:52 PM

Nice find. Patch LGTM but can we follow the current naming guidelines for sec patches? https://wikitech.wikimedia.org/wiki/How_to_deploy_code#Creating_a_Security_Patch. Thanks.

Catrope added a comment.Aug 27 2025, 5:07 PM

Sorry my bad, old habit. Updated patch attached.

T403093.patch1 KBDownload

sbassett awarded a token.Aug 27 2025, 6:23 PM
sbassett moved this task from Incoming to Security Patch To Deploy on the Security-Team board.
sbassett added projects: SecTeam-Processed, Patch-For-Review, Vuln-XSS.
Mstyles mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Aug 28 2025, 10:01 PM
Mstyles moved this task from Security Patch To Deploy to Watching on the Security-Team board.Aug 28 2025, 10:15 PM
Mstyles subscribed.
In T403093#11125429, @Catrope wrote:

Sorry my bad, old habit. Updated patch attached.

T403093.patch1 KBDownload

Deployed

Reedy moved this task from Backlog to Bugs on the MediaWiki-extensions-OATHAuth board.Sep 16 2025, 7:47 PM
Reedy closed this task as Resolved.Sep 17 2025, 1:39 PM
Reedy claimed this task.
Reedy reassigned this task from Reedy to Catrope.
Reedy added subscribers: gerritbot, Reedy.
gerritbot added a comment.Sep 17 2025, 2:22 PM

Change #1189174 merged by jenkins-bot:

[mediawiki/extensions/WebAuthn@master] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189174

gerritbot added a comment.Sep 17 2025, 2:22 PM

Change #1189206 had a related patch set uploaded (by Reedy; author: Catrope):

[mediawiki/extensions/WebAuthn@REL1_44] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189206

gerritbot added a comment.Sep 17 2025, 2:22 PM

Change #1189207 had a related patch set uploaded (by Reedy; author: Catrope):

[mediawiki/extensions/WebAuthn@REL1_43] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189207

gerritbot added a comment.Sep 17 2025, 2:23 PM

Change #1189208 had a related patch set uploaded (by Reedy; author: Catrope):

[mediawiki/extensions/WebAuthn@REL1_39] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189208

gerritbot added a comment.Sep 17 2025, 2:47 PM

Change #1189206 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_44] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189206

gerritbot added a comment.Sep 17 2025, 2:47 PM

Change #1189207 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_43] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189207

gerritbot added a comment.Sep 17 2025, 2:52 PM

Change #1189208 merged by Reedy:

[mediawiki/extensions/WebAuthn@REL1_39] SECURITY: Escape key name in management UI

https://gerrit.wikimedia.org/r/1189208

sbassett renamed this task from Stored XSS in WebAuthn key name to CVE-2025-62652: Stored XSS in WebAuthn key name.Oct 17 2025, 10:15 PM
sbassett triaged this task as Medium priority.
sbassett removed a project: Patch-For-Review.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Medium.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits