(In reply to Kevin Israel (PleaseStand) from comment #0)

This is an XSS vulnerability when $wgRawHTML = true.

Correction: when $wgRawHtml = true, as in the summary.

I wonder if action=submit (preview) is affected as well.

Created attachment 16597
WIP patch (master)

We might not want to reuse the existing error message from EditPage, though that's a minor issue.

The bigger issue is that anons always have the edit token "+\", and anyone who isn't logged into wikimediafoundation.org is an anon. That means my patch (at least so far) would not stop the XSS and everything possible with it (e.g. making CORS requests against other Wikimedia sites). Yikes!

attachment 0001-SECURITY-Add-edit-token-to-Special-ExpandTemplates.patch ignored as obsolete

Created attachment 16608
patch (master)

Issues should be mostly fixed now; please review.

Attached:

Kevin, apologies for the slow response on this!

The patch looks good, and prevents the issue in my testing. As a public patch, it seems like we might want to restrict the page to users with edit rights in general, which would remove the one special case you put in. But we'll avoid setting policy in security patches if we can help it.

Krinkle, I'm not seeing a way that preview can be abused in the same way, since EditPage checks permissions pretty early on. But ping me if you've thought of any specific ways to abuse this.

Kevin's patch is deployed, thanks!

20:19 csteipp: patched bugs 71111 and 71394 in wmf7 and wmf8

Markus, this can be added to the next release.

Backport to REL1_23. There's no special expand templates before that, so no further backports needed. If someone could confirm the backport, that would be very helpful.

In T73111#788005, @Mglaser wrote:

Backport to REL1_23. There's no special expand templates before that, so no further backports needed.

Special:ExpandTemplates is available for earlier MW versions as an extension. The patch should be backported to the REL1_19 and REL1_22 branches of that extension.

Just found an error in the previous patch for REL1_23, as it used the config wrapper instead of the global. Fixed patch here:

I ran Special:ExpandTemplates after applying the patches on REL1_24 and REL1_23. Tested with {{FULLPAGENAME}}, just to make sure the page still works.

In T73111#789157, @Mglaser wrote:

Just found an error in the previous patch for REL1_23, as it used the config wrapper instead of the global. Fixed patch here:

bug71111-REL1_23.patch5 KBDownload

This fixes the issue in my test

In T73111#788041, @PleaseStand wrote:

The patch should be backported to the REL1_19 and REL1_22 branches of that extension.

Done in https://gerrit.wikimedia.org/r/#/c/176312/ and https://gerrit.wikimedia.org/r/#/c/176303/, pending review.

Assigned CVE-2014-9276

Done in https://gerrit.wikimedia.org/r/#/c/176312/ and https://gerrit.wikimedia.org/r/#/c/176303/, pending review.

Just for documentation: This was merged.