CVE-2024-40599
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in the GuMaxDD skin for MediaWiki allows attackers to inject malicious scripts into top-level menu entries. When users view the affected sidebar menu, the scripts execute in their browser context. This affects all MediaWiki installations using the GuMaxDD skin up to version 1.42.1.
💻 Affected Systems
- MediaWiki with GuMaxDD skin
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, perform actions as authenticated users, deface the wiki, or redirect users to malicious sites.
Likely Case
Attackers with edit privileges inject malicious JavaScript into sidebar entries, compromising users who view those entries.
If Mitigated
With proper input validation and output encoding, malicious scripts would be rendered harmless as text.
🎯 Exploit Status
Requires edit access to MediaWiki:Sidebar namespace. XSS payloads are well-documented and easy to craft.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.42.2 or later
Vendor Advisory: https://phabricator.wikimedia.org/T361448
Restart Required: No
Instructions:
1. Update MediaWiki to version 1.42.2 or later. 2. Alternatively, update the GuMaxDD skin if available separately. 3. Clear caches after update.
🔧 Temporary Workarounds
Disable GuMaxDD skin
allSwitch to a different MediaWiki skin temporarily
Edit LocalSettings.php: $wgDefaultSkin = 'vector';
Restrict sidebar editing
allLimit who can edit MediaWiki:Sidebar namespace
Edit LocalSettings.php: $wgNamespaceProtection[NS_MEDIAWIKI] = ['editinterface'];
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to block inline scripts
- Regularly audit MediaWiki:Sidebar entries for suspicious JavaScript content
🔍 How to Verify
Check if Vulnerable:
Check if using GuMaxDD skin and MediaWiki version ≤1.42.1Check Version:
Check includes/DefaultSettings.php or Special:Version pageVerify Fix Applied:
Confirm MediaWiki version is ≥1.42.2 and test sidebar entries don't execute scripts📡 Detection & Monitoring
Log Indicators:
- Unusual edits to MediaWiki:Sidebar pages
- JavaScript in sidebar edit history
Network Indicators:
- Unexpected external script loads from wiki pages
SIEM Query:
source="mediawiki" AND (event="edit" AND page="MediaWiki:Sidebar")