CVE-2019-12471

Vulnerability

CVE-2019-12471 is a cross-site scripting (XSS) vulnerability in MediaWiki versions 1.30.0 through 1.32.1. The root cause is that MediaWiki allows loading user JavaScript from pages such as User:Foo/bar.js even when the user account Foo does not exist. This creates a dangerous situation where an attacker can register the non-existent account and then control the content of the script, leading to XSS when other users load it via importScript [1][3].

Exploitation

To exploit this vulnerability, an attacker only needs the ability to register a new account on the wiki (if registration is open) and then create a user script page under that account. Any user who loads the script via importScript('User:Foo/bar.js') will execute the attacker's JavaScript in their browser. No additional authentication or network position is required beyond standard wiki access [2][3].

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's session. This can lead to session hijacking, data theft, defacement, or other malicious actions performed on behalf of the victim [1][4].

Mitigation

The vulnerability is fixed in MediaWiki versions 1.32.2, 1.31.2, 1.30.2, and 1.27.6. The Debian security advisory DSA-4460-1 also addresses this issue [2][4]. Users are strongly advised to upgrade, especially as MediaWiki 1.30 and 1.27 have reached their end-of-life dates and will no longer receive security updates [2].