MediaWiki Cross-site Scripting (XSS) Vulnerability in mediawiki/core
Summary
CVE-2020-25812: MediaWiki Cross-site Scripting (XSS) vulnerability. Affects mediawiki/core across 2 version ranges.
>= 1.34.0, < 1.34.3
>= 1.35.0-rc.0, < 1.35.0
Fixed in 1.34.3 or 1.35.0, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-25812 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is an open-source wiki software used to power numerous websites, including Wikipedia. It provides a platform for collaborative editing and content management. The mediawiki/core package is the core component of MediaWiki, responsible for its fundamental functionality. Unfortunately, this package is susceptible to a Cross-site Scripting (XSS) vulnerability.
Vulnerability Detail
The identified vulnerability in MediaWiki 1.34.x before 1.34.3 involves the NS filter on the Special:Contributions page. The filter utilizes unescaped messages as keys in the option key for an HTMLForm specifier. This allows for a mild XSS attack if one of the messages is modified to include raw HTML. An attacker could exploit this vulnerability to inject malicious scripts or content into the affected page, potentially leading to unauthorized access, data theft, or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.34.0, < 1.34.31.34.3composer require mediawiki/core:1.34.3 -
>= 1.35.0-rc.0, < 1.35.01.35.0composer require mediawiki/core:1.35.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented. This involves manually escaping the messages used as keys in the option key for the HTMLForm specifier on the Special:Contributions page. By properly escaping the messages, the vulnerability can be mitigated until the upgrade can be performed. Here is an example of how the messages can be escaped in PHP:
$escapedMessage = htmlspecialchars( $message, ENT_QUOTES );
Conclusion
In conclusion, the mediawiki/core package in MediaWiki is vulnerable to a Cross-site Scripting (XSS) attack on the Special:Contributions page. Upgrading to version 1.34.3 or later is the recommended solution to fix this vulnerability. Alternatively, implementing the provided workaround can mitigate the risk until the upgrade is performed. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
MediaWiki is an open-source wiki software widely used for collaborative editing and content management. It powers websites like Wikipedia.
The mediawiki/core package is the core component of MediaWiki. It provides the fundamental functionality of the software.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts or content into web pages viewed by other users. This can lead to various attacks, such as session hijacking, data theft, or defacement.
This vulnerability in MediaWiki can allow an attacker to inject malicious scripts or content into the Special:Contributions page. This can potentially lead to unauthorized access, data theft, or other malicious activities.
To fix this vulnerability, it is recommended to upgrade to MediaWiki version 1.34.3 or later. This version includes a patch that addresses the XSS vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
