Page MenuHomePhabricator
Create Task
Maniphest T403923

CVE-2025-62653: Stored XSS through system messages in PollNY
Closed, ResolvedPublicSecurity
Actions

Assigned To
SomeRandomDeveloper
Authored By
SomeRandomDeveloper
Sep 7 2025, 8:20 PM
Project Tags
Referenced Files
F65986896: T403923-2.patch
Sep 8 2025, 5:20 PM
F65981477: T403923.patch
Sep 7 2025, 8:31 PM
F65981422: image.png
Sep 7 2025, 8:20 PM
F65981378: image.png
Sep 7 2025, 8:20 PM
Subscribers
Aklapper
ashley
gerritbot
sbassett
SomeRandomDeveloper

Description

The poll-js-action-complete, poll-finished and poll-js-loading system messages are inserted as raw HTML by the PollNY extension, allowing for stored XSS.

Deleting polls

Reproduction steps

  1. Make sure $wgUseXssLanguage is set to true
  2. Create a poll
  3. Go to /wiki/Special:AdminPoll?uselang=x-xss
  4. Delete a poll

image.png (511×213 px, 27 KB)

Cause

The message is retrieved unescaped using mw.msg and then inserted as raw HTML using jQuery's .html() function:
https://gerrit.wikimedia.org/g/mediawiki/extensions/PollNY/+/3805663fded6b92feaa8e67799a9b934b25d1274/resources/js/Poll.js#298

Changing a poll's status

Reproduction steps

  1. Make sure $wgUseXssLanguage is set to true
  2. Create a poll
  3. Go to /wiki/Special:AdminPoll?uselang=x-xss
  4. Change the status of a poll

image.png (511×213 px, 27 KB)

Cause

The message is retrieved unescaped using mw.msg and then inserted as raw HTML using jQuery's .html() function:
https://gerrit.wikimedia.org/g/mediawiki/extensions/PollNY/+/3805663fded6b92feaa8e67799a9b934b25d1274/resources/js/Poll.js#276

poll-finished

Reproduction steps

  1. Edit MediaWiki:Poll-finished to <img src="" onerror="alert(1)">
  2. Create a poll
  3. Go to the poll's page
  4. Click on the "Skip" link and keep skipping further polls until there are no more polls left

image.png (555×247 px, 11 KB)

Cause

LightBox.setText() takes raw HTML:
https://gerrit.wikimedia.org/g/mediawiki/extensions/PollNY/+/3805663fded6b92feaa8e67799a9b934b25d1274/resources/js/Poll.js#135

poll-js-loading

This one is only reproducible on Firefox on Mac, as the script checks for that before displaying the message, but it's quite obvious that it's an XSS as well, since setText takes HTML:
https://gerrit.wikimedia.org/g/mediawiki/extensions/PollNY/+/3805663fded6b92feaa8e67799a9b934b25d1274/resources/js/Poll.js#53

Additional information

  • MediaWiki: 1.44.0
  • PollNY: 3805663

Details

Risk Rating
Low
Author Affiliation
Wikimedia Communities
Related Changes in Gerrit:
SubjectAuthorRepoBranchLines +/-
SECURITY: Fix several stored i18n XSS vulnerabilitiesSomeRandomDevelopermediawiki/extensions/PollNYREL1_43+7 -6
SECURITY: Fix several stored i18n XSS vulnerabilitiesSomeRandomDevelopermediawiki/extensions/PollNYREL1_44+7 -6
SECURITY: Fix several stored i18n XSS vulnerabilitiesSomeRandomDevelopermediawiki/extensions/PollNYREL1_39+7 -6
SECURITY: Fix several stored i18n XSS vulnerabilitiesSomeRandomDevelopermediawiki/extensions/PollNYmaster+7 -6
Customize query in gerrit

Related Objects
Search...

StatusSubtypeAssignedTask
Restricted Task
 ResolvedSecuritySomeRandomDeveloperT403923 CVE-2025-62653: Stored XSS through system messages in PollNY

Event Timeline

SomeRandomDeveloper created this task.Sep 7 2025, 8:20 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 7 2025, 8:20 PM
SomeRandomDeveloper claimed this task.Sep 7 2025, 8:21 PM
SomeRandomDeveloper added projects: affects-Miraheze, Vuln-XSS, PollNY.
SomeRandomDeveloper added a subscriber: ashley.
SomeRandomDeveloper added a comment.EditedSep 7 2025, 8:25 PM

LightBox.setText is used with a system message in QuizGame too: https://gerrit.wikimedia.org/g/mediawiki/extensions/QuizGame/+/54352e7f398242788c579eb386b7c7316301b936/resources/js/QuizGame.js#412
I'll open a separate task later, but it should be considered whether the function should be renamed from setText to setHtml as text is supposed to be escaped.
Edit: Done with T403924

SomeRandomDeveloper added a project: Patch-For-Review.Sep 7 2025, 8:31 PM

T403923.patch2 KBDownload

SomeRandomDeveloper added a parent task: Restricted Task.Sep 7 2025, 8:32 PM
SomeRandomDeveloper mentioned this in T397776: Write and send supplementary release announcement for extensions and skins with security patches (1.39.14/1.43.4/1.44.1).
SomeRandomDeveloper added a subscriber: gerritbot.Sep 7 2025, 8:37 PM
sbassett subscribed.Sep 8 2025, 4:26 PM

Thanks, @SomeRandomDeveloper. This patch can go through gerrit whenever you have the time.

sbassett moved this task from Incoming to Watching on the Security-Team board.Sep 8 2025, 4:26 PM
sbassett added a project: SecTeam-Processed.
ashley added a project: Social-Tools.Sep 8 2025, 5:08 PM

Patch LGTM (not tested though, but I trust you), though I wonder...do the formats like .escaped(), .parse() etc. work just like that, i.e. don't you need to declare a dependency on mediawiki.jqueryMsg? (I think at one point you needed to, but that was literally years ago and core probably has changed a fair bit since that.)

Also re:Firefox on Mac special case handling, that could probably be removed altogether. It's a leftover from Adobe Flash (remember that thing?) days; see T391901 and whatnot. Basically Flash-capable browsers were served a Flash applet, others were served the same .gif image all other browsers these days are, and Mac on Firefox was treated differently because...I honestly don't know. What made sense back in 2006-2007 and that browser/OS/platform landscape doesn't necessarily make much sense anymore in 2025. :)

ashley mentioned this in T403924: CVE-2025-62654: Stored XSS through system messages in QuizGame.Sep 8 2025, 5:08 PM
ashley moved this task from Backlog to PollNY on the Social-Tools board.
SomeRandomDeveloper added a comment.Sep 8 2025, 5:20 PM
In T403923#11158964, @ashley wrote:

Patch LGTM (not tested though, but I trust you), though I wonder...do the formats like .escaped(), .parse() etc. work just like that, i.e. don't you need to declare a dependency on mediawiki.jqueryMsg? (I think at one point you needed to, but that was literally years ago and core probably has changed a fair bit since that.)

In theory you do need to, but in this case, there is already an indirect dependency on jQueryMsg through mediawiki.api. Though of course, it would be safer to still add an explicit dependency on jQueryMsg.

Updated patch with jQueryMsg as a dependency:

T403923-2.patch2 KBDownload

Also re:Firefox on Mac special case handling, that could probably be removed altogether. It's a leftover from Adobe Flash (remember that thing?) days; see T391901 and whatnot. Basically Flash-capable browsers were served a Flash applet, others were served the same .gif image all other browsers these days are, and Mac on Firefox was treated differently because...I honestly don't know. What made sense back in 2006-2007 and that browser/OS/platform landscape doesn't necessarily make much sense anymore in 2025. :)

Yes, that should probably be done afterwards in a separate non-security patch

ashley added a comment.Sep 8 2025, 5:25 PM
In T403923#11159001, @SomeRandomDeveloper wrote:

In theory you do need to, but in this case, there is already an indirect dependency on jQueryMsg through mediawiki.api. Though of course, it would be safer to still add an explicit dependency on jQueryMsg.

Updated patch with jQueryMsg as a dependency:

T403923-2.patch2 KBDownload

Awesome, feel free to push this to gerrit whenever you're ready! 🎉

Yes, that should probably be done afterwards in a separate non-security patch

👍

gerritbot added a comment.Sep 8 2025, 5:26 PM

Change #1185999 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/PollNY@master] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1185999

gerritbot added a comment.Sep 8 2025, 5:27 PM

Change #1186000 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/PollNY@REL1_44] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1186000

gerritbot added a comment.Sep 8 2025, 5:27 PM

Change #1186001 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/PollNY@REL1_43] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1186001

gerritbot added a comment.Sep 8 2025, 5:27 PM

Change #1186002 had a related patch set uploaded (by SomeRandomDeveloper; author: SomeRandomDeveloper):

[mediawiki/extensions/PollNY@REL1_39] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1186002

gerritbot added a comment.Sep 8 2025, 5:29 PM

Change #1185999 merged by Jack Phoenix:

[mediawiki/extensions/PollNY@master] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1185999

gerritbot added a comment.Sep 8 2025, 5:53 PM

Change #1186002 merged by Jack Phoenix:

[mediawiki/extensions/PollNY@REL1_39] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1186002

gerritbot added a comment.Sep 8 2025, 6:04 PM

Change #1186000 merged by jenkins-bot:

[mediawiki/extensions/PollNY@REL1_44] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1186000

gerritbot added a comment.Sep 8 2025, 6:12 PM

Change #1186001 merged by jenkins-bot:

[mediawiki/extensions/PollNY@REL1_43] SECURITY: Fix several stored i18n XSS vulnerabilities

https://gerrit.wikimedia.org/r/1186001

SomeRandomDeveloper closed this task as Resolved.Sep 8 2025, 6:34 PM

Merged and backported, thanks @ashley!

SomeRandomDeveloper added a comment.Sep 8 2025, 7:54 PM
In T403923#11159001, @SomeRandomDeveloper wrote:

Yes, that should probably be done afterwards in a separate non-security patch

Done with https://gerrit.wikimedia.org/r/c/mediawiki/extensions/PollNY/+/1186046.

sbassett triaged this task as Low priority.Sep 15 2025, 4:13 PM
sbassett removed a project: Patch-For-Review.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.
sbassett renamed this task from Stored XSS through system messages in PollNY to CVE-2025-62653: Stored XSS through system messages in PollNY.Oct 17 2025, 10:22 PM
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits