CVE-2024-34500: MediaWiki UnlinkedWikibase XSS Vulnerability
Summary
CVE-2024-34500: MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability. Affects samwilson/unlinked-wikibase versions < 1.42.0. Fixed in 1.42.0. How to fix ↓
Also tracked for
- mediawiki · Bitnami
The same CVE-2024-34500 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The UnlinkedWikibase extension for MediaWiki is designed to enhance the functionality of MediaWiki installations by allowing users to link and manage Wikibase data effectively. This extension is widely used in various applications that require a robust framework for handling linked data. However, it has been found to be vulnerable to a Cross-site Scripting (XSS) attack, which can compromise the security of applications utilizing this extension.
Vulnerability Detail
An issue has been identified in the UnlinkedWikibase extension of MediaWiki versions prior to 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. The vulnerability arises from the improper handling of error messages in the getError() function within the Hooks class. Specifically, the error messages stored in the $err variable are not properly escaped before being passed to the Html::rawElement() function, allowing an attacker to inject malicious scripts through the interface message. This could lead to unauthorized actions being executed in the context of the affected user’s session, potentially compromising sensitive information.
How To Fix
Minimum fixed version
1.42.0
This is the first release that contains the fix.
composer require samwilson/unlinked-wikibase:1.42.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can sanitize any user input that may be displayed in error messages to prevent XSS attacks. This can be done by escaping output before rendering it in the UI. However, this is not a substitute for applying the official patch.
Conclusion
The UnlinkedWikibase extension for MediaWiki has a critical XSS vulnerability that can be exploited if not addressed. It is crucial for users to update to the latest patched versions to ensure the security of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for samwilson/unlinked-wikibase →
FAQ
The vulnerability is a Cross-site Scripting (XSS) issue that allows attackers to inject malicious scripts through unescaped error messages.
Versions of the UnlinkedWikibase extension prior to 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1 are affected.
You can use Vulert, which monitors open-source vulnerabilities in real-time. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
If exploited, this vulnerability can allow attackers to execute unauthorized actions in the context of the affected user's session, potentially leading to data theft or manipulation.
While the best solution is to update to a patched version, you can temporarily sanitize user inputs to prevent XSS attacks, but this is not a long-term solution.
