Executive brief
The MassMessage extension for MediaWiki, a wiki collaboration platform, contains a cross-site scripting (XSS) vulnerability in its form help text. An attacker can craft a malicious URL with a specially crafted language parameter to inject arbitrary JavaScript code that executes in a user's browser when viewing the MassMessage form, potentially allowing account compromise or unauthorized actions on the wiki.
Technical details
The vulnerability is an i18n-based XSS (information disclosure / code injection) in the MassMessage extension affecting MediaWiki before version 1.40.2. The issue occurs because the massmessage-form-page-help i18n key is rendered without proper escaping when using the 'help' attribute in HTMLFormField, which does not escape HTML content. When an attacker accesses Special:MassMessage with a crafted uselang parameter (e.g., uselang=x-xss), malicious JavaScript embedded in the i18n message is executed. The fix involves using the 'help-message' attribute instead of 'help', which properly escapes content. No authentication is required; the attack is triggered by user interaction with a specially crafted link. Patches are available in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0.
Affected products
- Wikimedia MediaWiki before 1.35.14, 1.39.x before 1.39.6, 1.40.x before 1.40.2
- Wikimedia MassMessage extension bundled with affected MediaWiki versions
Timeline
- 2023-09-29: disclosed: Vulnerability reported
- 2023-12-21: patched: Fixed in MediaWiki 1.35.14, 1.39.6, 1.40.2, and 1.41.0-rc.0