Page MenuHomePhabricator

CVE-2025-61644: i18n XSS through Special:Watchlist
Closed, ResolvedPublicSecurity

Description

When using the x-xss language added by https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1183701 on Special:Watchlist, alerts appear to indicate that there are some problem messages.

Messages

Message nameAlert in the page
rcfilters-watchlist-edit-watchlist-button
image.png (314×936 px, 24 KB)
rcfilters-watchlist-edit-watchlist-preferences-button
image.png (338×981 px, 29 KB)

Acceptance criteria

  • Special:Watchlist is no longer vulnerable to i18n XSS

Details

Risk Rating
Low
Author Affiliation
WMF Technology
Related Changes in Gerrit:

Event Timeline

Should this not have been done through a security patch and not on gerrit?

Please do NOT upload security patches to gerrit. Please overwrite it with a different commit and abandon it, thanks

I think the issue this fixes was only introduced in fb856ce9cf121e046305116852cca4899ecb48ca, so it does not exist on a release version.

However, the issue is unpatched in WMF production so we should still use the security patch process to fix the issue first AFAICS.

I was told by @sbassett in T360407#9654079 that i18n xss patches are low-risk enough to publish through Gerrit.

I think the issue this fixes was only introduced in fb856ce9cf121e046305116852cca4899ecb48ca, so it does not exist on a release version.

I can reproduce it on my localhost instance on master, so I don't think it's fixed yet.

I was told by @sbassett in T360407#9654079 that i18n xss patches are low-risk enough to publish through Gerrit.

Perhaps, though that example you give was for an extension (ReadingLists) which isn't bundled.

That may have been the case a year ago, but it is not anymore. Especially not for MW core

I think the issue this fixes was only introduced in fb856ce9cf121e046305116852cca4899ecb48ca, so it does not exist on a release version.

I can reproduce it on my localhost instance on master, so I don't think it's fixed yet.

It was introduced in that version, not fixed.

It was introduced in thar version, not fixed.

Ah, right, I misread you – sorry.

That may have been the case a year ago, but it is not anymore. Especially not for MW core

Alright, did what you suggested. Attaching patch here instead.

I was told by @sbassett in T360407#9654079 that i18n xss patches are low-risk enough to publish through Gerrit.

I think most of these message-related XSS patches are generally low-risk enough to go through gerrit, if they get posted there. They are still very difficult to exploit since you'd need to compromise an int/ifadmin account or figure out how to successfully bypass our code-review processes for TWN and MediaWiki. That being said, it's probably a best practice to post a proposed security patch on the task, to keep it private, and then we can make the decision on a case-by-case basis. This could probably be better documented on https://wikitech.wikimedia.org/wiki/How_to_deploy_code#Security_patches.

That may have been the case a year ago, but it is not anymore. Especially not for MW core

Alright, did what you suggested. Attaching patch here instead.

The code in the patch itself looks fine, but can we create a proper security patch? e.g. have a subject line beginning with SECURITY:, have a standard commit message and Bug: reference, etc. See also: https://wikitech.wikimedia.org/wiki/How_to_deploy_code#Creating_a_Security_Patch

Thanks for the input! New patch file created the right way included:

Thanks for the input! New patch file created the right way included:

LGTM, CR+2. Thanks.

sbassett removed a project: Patch-For-Review.

The above patch was deployed today to wmf.17: https://sal.toolforge.org/log/uHuhFpkBvg159pQrAZsF. Seems stable so far.

Reedy renamed this task from i18n XSS through Special:Watchlist to CVE-2025-61644: i18n XSS through Special:Watchlist.Sep 29 2025, 1:29 PM

Change #1193224 had a related patch set uploaded (by Reedy; author: Jon Harald Søby):

[mediawiki/core@master] SECURITY: Fix XSS vulnerability in Special:Watchlist

https://gerrit.wikimedia.org/r/1193224

Change #1193224 merged by jenkins-bot:

[mediawiki/core@master] SECURITY: Fix XSS vulnerability in Special:Watchlist

https://gerrit.wikimedia.org/r/1193224

jsn.sherman subscribed.

I'm not seeing any alerts when I check this now; marking as resolved.

sbassett removed a project: Patch-For-Review.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.