CVE-2020-25812

Vulnerability

Overview

An issue in MediaWiki versions 1.34.x before 1.34.4 allowed cross-site scripting (XSS) on the Special:Contributions page. The NS filter option keys were built using unescaped messages from the invert and namespace_association system messages, as seen in the source code [1]. If an attacker could alter these messages (e.g., through editinterface rights or compromised localization), they could inject raw HTML into the page.

Exploitation

Prerequisites

Exploitation requires the ability to modify MediaWiki system messages, typically limited to administrators with editinterface permission. The XSS fires when a victim views Special:Contributions because the unescaped message values become part of the HTML form [2]. No special user interaction beyond viewing the page is needed.

Impact

An attacker can execute arbitrary HTML or JavaScript in the context of the victim's browser, potentially leading to session theft, defacement, or disclosure of sensitive information [3]. The severity is considered mild due to the administrative prerequisite, but it still poses a risk on wikis where message customization is allowed.

Mitigation

The fix replaces ->text() with ->escaped() when generating the option keys, ensuring proper HTML escaping [2]. The vulnerability is addressed in MediaWiki 1.34.4 and later releases; administrators should upgrade or apply the patch [4].