MediaWiki

User:CSteipp (WMF)/SecurityRelease 1.24.1

< User:CSteipp (WMF)

thumb.php outputs wikitext message as raw html edit

  • Bug: T76686
  • Affected Versions: ???-1.24.1 (introduced in , fixed in )
  • Type: Security Hardening
  • CVE:
  • Credit: Krinkle

Background:

Issues: The badtitletext message could allow a malicious admin to add a malicious script to mediawiki in a way that is unlikely to be noticed by other administrators.

Fix: Parse the error message instead of outputting the raw message in thumb.php

Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains edit

  • Bug: T77028
  • Affected Versions: ???-1.24.1 (introduced in , fixed in )
  • Type: Improper Authorization / CWE-285
  • CVE:
  • Credit: BJorsh (WMF)

Background: Responding with valid CORS headers from another domain can be restricted to a list of domains, set in the array $wgCrossSiteAJAXdomains. The list can include wildcard domains, to include all subdomains of a single domain.

Issues: The wildcard regex to test if a domain was included on the list only checked that the string in $wgCrossSiteAJAXdomains was contained in the requesting site's name, instead of checking that the requesting site was a subdomain.

Fix: Parse the error message instead of outputting the raw message in thumb.php

Retrieved from "https://www.mediawiki.org/w/index.php?title=User:CSteipp_(WMF)/SecurityRelease_1.24.1&oldid=1348760"