Page MenuHomePhabricator
Create Task
Maniphest T347744

i18n-xss vectors on Special:SecurePoll
Closed, ResolvedPublicSecurity
Actions

Description

Steps to reproduce

  1. Add $wgUseXssLanguage = true; to your LocalSettings.php (a new feature from T340201)
  2. Install the SecurePoll extension
  3. Load http://localhost:8080/wiki/Special:SecurePoll?uselang=x-xss

On this page there are several alerts that appear with the text being from the following:

  • march (suggesting a unescaped ::userDate call)
  • pipe-separator
  • securepoll-subpage-archive

Details

Risk Rating
Low
Author Affiliation
Wikimedia Communities
SubjectRepoBranchLines +/-
Fix non-escaped messages returned by TablePager::formatValuemediawiki/extensions/SecurePollREL1_41+30 -9
Fix non-escaped messages returned by TablePager::formatValuemediawiki/extensions/SecurePollREL1_40+30 -9
Fix non-escaped messages returned by TablePager::formatValuemediawiki/extensions/SecurePollREL1_39+30 -9
Fix non-escaped messages returned by TablePager::formatValuemediawiki/extensions/SecurePollmaster+30 -9
Customize query in gerrit

Related Objects
Search...

Event Timeline

Dreamy_Jazz created this task.Sep 29 2023, 5:38 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptSep 29 2023, 5:38 PM
Dreamy_Jazz added a project: MediaWiki-extensions-SecurePoll.Sep 29 2023, 5:38 PM
Bawolff subscribed.Sep 29 2023, 5:58 PM

This seems similar to T347708 in that its also related to Phan taint check not being able to check the Pager class hierarchy very well.

Dreamy_Jazz updated the task description. (Show Details)Sep 29 2023, 5:59 PM
sbassett edited projects, added SecTeam-Processed, Vuln-XSS; removed Security-Team.Oct 2 2023, 4:14 PM
sbassett added a project: security-bug.Nov 15 2023, 8:18 PM
sbassett added subscribers: Umherirrender, Reedy, Tchanders, sbassett.

Adding a few potential maintainers...

Umherirrender added a parent task: T2212: Some MediaWiki: messages not safe in HTML (tracking).Nov 15 2023, 8:45 PM
Umherirrender claimed this task.EditedNov 15 2023, 8:50 PM

Uploaded a (public) patch as only the message processing is affected (and not arguments to messages, which could be user-controlled) and that always treated as low risk

Umherirrender updated the task description. (Show Details)Nov 15 2023, 8:53 PM
Umherirrender added a comment.Nov 15 2023, 8:56 PM
In T347744#9211868, @Bawolff wrote:

This seems similar to T347708 in that its also related to Phan taint check not being able to check the Pager class hierarchy very well.

There is T347787 to track that further.

sbassett added subscribers: Daimona, gerritbot.Nov 16 2023, 5:35 PM
In T347744#9335506, @Umherirrender wrote:

Uploaded a (public) patch as only the message processing is affected (and not arguments to messages, which could be user-controlled) and that always treated as low risk

Change set: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SecurePoll/+/974684

Happy to +2 that if nobody else does, but like @Daimona, I'm not a maintainer of the repo.

gerritbot added a comment.Nov 17 2023, 7:07 AM

Change 974684 merged by jenkins-bot:

[mediawiki/extensions/SecurePoll@master] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/974684

Jdforrester-WMF added a project: MW-1.42-notes (1.42.0-wmf.7; 2023-11-28).Nov 17 2023, 2:37 PM
gerritbot added a comment.Nov 17 2023, 7:44 PM

Change 975043 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/extensions/SecurePoll@REL1_41] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/975043

gerritbot added a project: Patch-For-Review.Nov 17 2023, 7:44 PM

Change 975044 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/extensions/SecurePoll@REL1_40] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/975044

gerritbot added a comment.Nov 17 2023, 7:45 PM

Change 975045 had a related patch set uploaded (by Umherirrender; author: Umherirrender):

[mediawiki/extensions/SecurePoll@REL1_39] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/975045

gerritbot added a comment.Nov 17 2023, 8:03 PM

Change 975045 merged by jenkins-bot:

[mediawiki/extensions/SecurePoll@REL1_39] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/975045

gerritbot added a comment.Nov 17 2023, 8:03 PM

Change 975044 merged by jenkins-bot:

[mediawiki/extensions/SecurePoll@REL1_40] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/975044

gerritbot added a comment.Nov 17 2023, 8:03 PM

Change 975043 merged by jenkins-bot:

[mediawiki/extensions/SecurePoll@REL1_41] Fix non-escaped messages returned by TablePager::formatValue

https://gerrit.wikimedia.org/r/975043

Umherirrender removed a project: Patch-For-Review.Nov 17 2023, 8:11 PM
sbassett mentioned this in T347659: Write and send supplementary release announcement for extensions and skins with security patches (1.35.14/1.39.6/1.40.2/1.41.0).Nov 22 2023, 5:06 PM
Dreamy_Jazz mentioned this in T347708: CVE-2024-23172: Several not properly escaped messages in the CheckUser extension.Jan 8 2024, 8:01 PM
sbassett mentioned this in T353904: Write and send supplementary release announcement for extensions and skins with security patches (1.39.7/1.40.3/1.41.1).Jan 16 2024, 10:42 PM
Dreamy_Jazz added a comment.Apr 2 2024, 8:14 PM

I think this task be made public and closed now? I can't seem to get any alerts to appear by following the steps to re-produce.

sbassett closed this task as Resolved.Apr 2 2024, 10:14 PM
sbassett triaged this task as Low priority.
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Low.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits