CVE-2020-10959

Vulnerability

Overview

The vulnerability, identified as CVE-2020-10959, resides in the resources/src/mediawiki.page.ready/ready.js component of MediaWiki versions prior to 1.35 [1]. The root cause is that the client-side JavaScript used for handling logout button clicks did not sufficiently restrict the destination URL [2]. An attacker can inject crafted HTML content into a wiki page that manipulates the logout button's target, enabling an open redirect upon user interaction [1].

Exploitation

Details

To exploit this flaw, an attacker must have the ability to create or edit wiki pages (which often requires an authenticated account with appropriate permissions) [1]. The attacker inserts HTML such as [https://www.example.com/ click] into the page content [1]. When a logged-in victim views the manipulated page and clicks the logout button, the browser performs the logout action but is then redirected to the attacker-controlled URL [1][2]. The attack is low-complexity, requires no special privileges beyond the ability to add content, and can be triggered without any user interaction beyond loading the manipulated page [1].

Impact

A successful exploit allows an attacker to force a user's logout from the wiki and subsequently redirect the browser to an arbitrary external website [1]. This can be abused for information disclosure through post-logout redirects to credential harvesting sites or to deliver phishing attacks, thereby undermining the integrity of the wiki's security [1][2]. The vulnerability does not directly enable code execution or privilege escalation but facilitates social engineering and session manipulation.

Mitigation

Status

The issue was fixed in MediaWiki 1.35 by adding the data-mw="interface" HTML attribute to the logout button and updating the jQuery selector to target [data-mw="interface"] [1][2]. This attribute is automatically filtered from user-generated content, preventing the redirect manipulation [1]. The patch was committed as Gerrit change 536725 (commit rMWd4a552e65bdf) and is also documented in the FriendsOfPHP security advisory [3]. Users are strongly advised to upgrade to the latest stable version to mitigate the risk [2][4].