CVE-2024-40605
📋 TL;DR
This stored cross-site scripting (XSS) vulnerability in MediaWiki's Foreground skin allows attackers to inject malicious scripts into top-level menu entries. When users view the sidebar, these scripts execute in their browser context, potentially stealing session cookies or performing unauthorized actions. All MediaWiki installations using the Foreground skin through version 1.42.1 are affected.
💻 Affected Systems
- MediaWiki with Foreground skin
📦 What is this software?
Mediawiki by Mediawiki
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain administrative privileges, deface the wiki, or install backdoors through malicious JavaScript execution.
Likely Case
Session hijacking of logged-in users, credential theft, or defacement of wiki pages through injected content.
If Mitigated
Limited impact if proper Content Security Policy (CSP) headers are implemented and user input validation is enforced elsewhere.
🎯 Exploit Status
Exploitation requires edit permissions to modify MediaWiki:Sidebar entries. Attack complexity is low once access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.42.2 or later
Vendor Advisory: https://phabricator.wikimedia.org/T361452
Restart Required: No
Instructions:
1. Update MediaWiki to version 1.42.2 or later. 2. Alternatively, apply the security patch from the Wikimedia Phabricator ticket T361452. 3. Clear any cached sidebar content.
🔧 Temporary Workarounds
Disable Foreground skin
allSwitch to a different MediaWiki skin that is not vulnerable
$wgDefaultSkin = 'vector';
Restrict sidebar editing
allLimit who can edit MediaWiki:Sidebar to trusted administrators only
🧯 If You Can't Patch
- Implement strict Content Security Policy headers to block inline script execution
- Regularly audit and sanitize MediaWiki:Sidebar entries for suspicious content
🔍 How to Verify
Check if Vulnerable:
Check if using MediaWiki ≤1.42.1 with Foreground skin enabled. Review LocalSettings.php for $wgDefaultSkin or $wgSkipSkins configuration.Check Version:
Check includes/DefaultSettings.php or run MediaWiki maintenance script: php maintenance/run.php --versionVerify Fix Applied:
Verify MediaWiki version is ≥1.42.2 and test that script tags in sidebar entries no longer execute.📡 Detection & Monitoring
Log Indicators:
- Unusual edits to MediaWiki:Sidebar page
- Multiple failed edit attempts to sidebar
Network Indicators:
- Unexpected JavaScript execution from sidebar content
- External resource loads from sidebar entries
SIEM Query:
source="mediawiki.log" AND ("MediaWiki:Sidebar" OR "edit sidebar") AND user NOT IN [admin_users]