MediaWiki - Cross Site Scripting (XSS) in SVG Uploads
Summary
DSA-3036-1: mediawiki - security update. Affects mediawiki versions < 1:1.19.19+dfsg-0+deb7u1. Fixed in 1:1.19.19+dfsg-0+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a popular wiki engine used to power websites like Wikipedia. It allows users to create and edit content collaboratively. MediaWiki supports the upload of SVG files, which are vector graphics files that can contain embedded code. This vulnerability in MediaWiki allows for cross-site scripting (XSS) attacks through uploaded SVG files.
Vulnerability Detail
The vulnerability arises from the insufficient filtering of CSS in uploaded SVG files. This allows an attacker to inject malicious code into the SVG file, which is then executed by the victim's browser when viewing the file. This can lead to various consequences, such as stealing sensitive information, session hijacking, or defacing the website.
How To Fix
Minimum fixed version
1:1.19.19+dfsg-0+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround is to disable the upload of SVG files or implement strict content filtering for uploaded SVG files. This can be achieved by modifying the MediaWiki configuration or using additional security plugins.
Conclusion
MediaWiki users are advised to upgrade their packages to the fixed version or apply the recommended workaround to mitigate the risk of cross-site scripting attacks through uploaded SVG files. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your MediaWiki installation is affected by this vulnerability. Simply upload your package manifest file (e.g., package-lock.json) and Vulert will analyze it for vulnerabilities in real-time.
Yes, this vulnerability can be exploited remotely. An attacker can upload a malicious SVG file to a vulnerable MediaWiki installation, and when other users view the file, the malicious code will be executed in their browsers.
There have been reported instances of this vulnerability being exploited in the wild. It is important to promptly apply the recommended fix or workaround to mitigate the risk.
Yes, a patch is available for this vulnerability. Upgrading the MediaWiki package to version 1:1.19.19+dfsg-0+deb7u1 or later will address the issue.
The potential consequences of this vulnerability include unauthorized access to sensitive information, session hijacking, and defacement of the affected MediaWiki website.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
