CVE-2025-62656: GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS
Closed, ResolvedPublicSecurity
Actions

Description

The Special:GlobalBlockList page is vulnerable to message key XSS through several messages.

Problem messages

The problem messages are:

globalblocking-block-flag-account-creation-disabled
globalblocking-block-flag-autoblock-disabled

There may be other message keys that are problems, because this seems to be to all global block flags as opposed to specific global block flags:

Acceptance criteria

Special:GlobalBlockList page is not vulnerable to message key XSS

Details

Risk Rating: Low
Author Affiliation: WMF Product

Related Changes in Gerrit:

Subject	Author	Repo	Branch	Lines +/-
Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer	Dreamy Jazz	mediawiki/extensions/GlobalBlocking	master	+4 -4
Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer	Dreamy Jazz	mediawiki/extensions/GlobalBlocking	REL1_43	+3 -3
Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer	Dreamy Jazz	mediawiki/extensions/GlobalBlocking	REL1_44	+4 -4
Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer	Dreamy Jazz	mediawiki/extensions/GlobalBlocking	REL1_39	+358 -0

Customize query in gerrit

Related Objects

Mentioned In: T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1)

Event Timeline

Dreamy_Jazz created this task.Aug 29 2025, 5:21 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptAug 29 2025, 5:21 PM

Dreamy_Jazz added projects: Vuln-XSS, GlobalBlocking.Aug 29 2025, 5:21 PM

Restricted Application added a project: Trust and Safety Product Team. · View Herald TranscriptAug 29 2025, 5:21 PM

Dreamy_Jazz added a project: Essential-Work.Aug 29 2025, 5:22 PM

Dreamy_Jazz added subscribers: OKryva-WMF, • hector.arroyo, mszwarc.

Dreamy_Jazz moved this task from Inbox to Engineering on the Trust and Safety Product Team board.Aug 29 2025, 5:32 PM

OKryva-WMF added a project: Trust and Safety Product Sprint.Sep 1 2025, 9:11 AM

OKryva-WMF moved this task from Backlog to Maintenance to triage on the Trust and Safety Product Sprint board.

sbassett moved this task from Incoming to In Progress on the Security-Team board.Sep 2 2025, 5:28 PM

sbassett added a project: SecTeam-Processed.

sbassett added a subscriber: mmartorana.

For the 2 messages implicated in this task, it looks like codesearch finds 4 problematic instances of each (1, 2)? And the solution should just be a s/text/escaped/.

Probably? I don't know if the messages are a problem on Special:Log as I can't seem to trigger the i18n XSS locally with my GlobalBlocking logs.

@sbassett can we do this fix publicly? I think the risk is low enough here, especially as the extension is not bundled.

Dreamy_Jazz edited projects, added: Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26)); removed: Trust and Safety Product Sprint.Sep 4 2025, 2:14 PM

In T403291#11148106, @Dreamy_Jazz wrote:

@sbassett can we do this fix publicly? I think the risk is low enough here, especially as the extension is not bundled.

I'm fine with that as I think this and similar issues are fairly low risk. It would nice though to time this so that the patch wasn't in gerrit for that long, e.g. push, CR and merge it in gerrit on a Monday before TrainBranchBot runs.

sbassett changed Author Affiliation from N/A to WMF Product.Sep 4 2025, 3:05 PM

sbassett changed Risk Rating from N/A to Low.

OKryva-WMF moved this task from Priority Backlog to Maintenance Ready on the Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26)) board.Sep 4 2025, 3:06 PM

Change #1185980 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/GlobalBlocking@master] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1185980

gerritbot added a project: Patch-For-Review.Sep 8 2025, 4:22 PM

In T403291#11148407, @sbassett wrote:

In T403291#11148106, @Dreamy_Jazz wrote:

@sbassett can we do this fix publicly? I think the risk is low enough here, especially as the extension is not bundled.

I'm fine with that as I think this and similar issues are fairly low risk. It would nice though to time this so that the patch wasn't in gerrit for that long, e.g. push, CR and merge it in gerrit on a Monday before TrainBranchBot runs.

Thanks. I've created the patch and will ask for someone on the team to review today.

Change #1185980 merged by jenkins-bot:

[mediawiki/extensions/GlobalBlocking@master] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1185980

Jdforrester-WMF added a project: MW-1.45-notes (1.45.0-wmf.18; 2025-09-09).Sep 8 2025, 6:01 PM

Dreamy_Jazz moved this task from Needs Review to Needs QA on the Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26)) board.Sep 9 2025, 11:51 AM

Dreamy_Jazz moved this task from Needs QA to Done on the Trust and Safety Product Sprint (Sprint Dadar Gulung (September 8 - September 26)) board.Sep 9 2025, 1:31 PM

Change #1188800 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/GlobalBlocking@REL1_44] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1188800

Change #1188802 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/GlobalBlocking@REL1_43] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1188802

Change #1188804 had a related patch set uploaded (by Dreamy Jazz; author: Dreamy Jazz):

[mediawiki/extensions/GlobalBlocking@REL1_39] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1188804

Change #1188804 abandoned by Dreamy Jazz:

[mediawiki/extensions/GlobalBlocking@REL1_39] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

Reason:

Release 1.39 does not have this problem

https://gerrit.wikimedia.org/r/1188804

Dreamy_Jazz closed this task as Resolved.Sep 16 2025, 2:53 PM

sbassett mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).Sep 16 2025, 3:04 PM

Change #1188800 merged by jenkins-bot:

[mediawiki/extensions/GlobalBlocking@REL1_44] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1188800

Change #1188802 merged by jenkins-bot:

[mediawiki/extensions/GlobalBlocking@REL1_43] Properly escape block flags in GlobalBlockingGlobalBlockDetailsRenderer

https://gerrit.wikimedia.org/r/1188802

Reedy removed a project: Patch-For-Review.Sep 17 2025, 1:45 PM

sbassett renamed this task from GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS to CVE-2025-62656: GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSS.Oct 20 2025, 8:15 PM

sbassett triaged this task as Low priority.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

	F65931620: image.png
	Aug 29 2025, 5:21 PM

CVE-2025-62656: GlobalBlocking Special:GlobalBlockList vulnerable to message key stored XSSClosed, ResolvedPublicSecurityActions