CVE-2008-5250

Vulnerability

A cross-site scripting (XSS) vulnerability exists in MediaWiki versions before 1.6.11, 1.12.x before 1.12.2, and 1.13.x before 1.13.3. The issue is described as a "local script injection vulnerability" that affects Internet Explorer clients on all installations with uploads enabled, and clients with SVG scripting capability (such as Firefox 1.5+) on installations with SVG uploads enabled [1]. This allows authenticated users to inject arbitrary web script or HTML by editing a wiki page.

Exploitation

An attacker must have an authenticated account on the target wiki and the ability to edit pages. When Internet Explorer is used, uploads must be enabled; when an SVG scripting-capable browser is used, SVG uploads must be enabled. The attacker crafts a malicious edit that, when rendered by a victim's browser, executes injected script. The victim must visit the crafted page to trigger the attack [1].

Impact

Successful exploitation allows an attacker to inject arbitrary web script or HTML in the context of the affected wiki, potentially stealing the victim's login session and performing actions on the wiki as that user [1]. The attack is limited to authenticated users and requires specific browser and upload configurations.

Mitigation

Mitigation is achieved by upgrading to the fixed versions: MediaWiki 1.6.11, 1.12.2, or 1.13.3, released on December 15, 2008 [1]. Users of the development trunk branch should upgrade to revision 44506 or later. No workaround is available other than disabling uploads or SVG uploads, as applicable.