CVE-2024-34500

Vulnerability

CVE-2024-34500 describes a cross-site scripting (XSS) vulnerability in the UnlinkedWikibase extension for MediaWiki. The issue lies in the getError() function within the Hooks class, where error messages stored in the $err variable are not escaped before being passed to Html::rawElement(). This allows an attacker who can control interface messages to inject arbitrary HTML and JavaScript into the rendered output. [1][2]

Exploitation

Exploitation requires the attacker to have permission to modify interface messages (e.g., through the MediaWiki message system). When an error is triggered, the unescaped message is passed to Html::rawElement(), which renders it as raw HTML. This can lead to stored XSS if the attacker can set a malicious interface message that is later displayed as an error. The vulnerability was reported via the Wikimedia Phabricator and has a risk rating of Low due to the elevated permissions needed. [1]

Impact

A successful attack could allow the attacker to inject arbitrary scripts or HTML into the wiki interface, potentially leading to session hijacking, defacement, or other actions in the context of the victim's browser. However, the privilege requirement limits the exploit's reach. [1][2]

Mitigation

The vulnerability is fixed in MediaWiki versions 1.39.6, 1.40.2, and 1.41.1. The patch changes the message handling from ->text() to ->escaped() to ensure output is safely escaped. Users are advised to update their installations immediately. The fix is available in the Gerrit change at reference [2].