DSA-2957-1: mediawiki - security update
Summary
DSA-2957-1: mediawiki - security update. Affects mediawiki versions < 1:1.19.16+dfsg-0+deb7u1. Fixed in 1:1.19.16+dfsg-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mediawiki is a popular wiki engine used for creating and managing collaborative websites. It provides a platform for users to create and edit content in a structured manner. This vulnerability affects Mediawiki versions with $wgRawHtml enabled, allowing an unauthenticated attacker to insert malicious JavaScript through invalid usernames on the Special:PasswordReset page. This can lead to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability arises from the way Mediawiki handles invalid usernames on the Special:PasswordReset page. When $wgRawHtml is enabled, the input is parsed as wikitext, allowing an attacker to inject malicious JavaScript code. By crafting a specially crafted username, an attacker can execute arbitrary code in the context of the victim's browser, potentially leading to session hijacking, data theft, or other malicious activities.
How To Fix
Minimum fixed version
1:1.19.16+dfsg-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading immediately is not feasible, a temporary workaround is to disable the $wgRawHtml feature in the Mediawiki configuration. This can be done by modifying the configuration file and setting $wgRawHtml to false. However, this workaround may impact certain functionality that relies on raw HTML input.
Conclusion
The vulnerability in Mediawiki allows an unauthenticated attacker to execute arbitrary JavaScript code through invalid usernames on the Special:PasswordReset page. Upgrading to the patched versions or disabling the $wgRawHtml feature are recommended solutions. It is crucial to apply these fixes to prevent potential XSS attacks and protect the integrity of the wiki content. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki →
FAQ
The vulnerability allows an unauthenticated attacker to execute arbitrary JavaScript code on the affected Mediawiki instance. This can lead to various malicious activities, including session hijacking, data theft, and defacement of the wiki pages.
Yes, this vulnerability can be exploited remotely by sending a specially crafted request to the affected Mediawiki instance.
There have been no known instances of this vulnerability being exploited in the wild at the time of this advisory. However, it is important to apply the necessary patches to mitigate the risk.
No, there is no specific CVSS score provided for this vulnerability in the advisory.
For more information about this vulnerability, you can refer to the Debian Security Advisory DSA-2957-1.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
