CVE-2024-47840
📋 TL;DR
This stored XSS vulnerability in MediaWiki's Apex skin allows attackers to inject malicious scripts into web pages, which execute when other users view those pages. It affects MediaWiki installations using the Apex skin in specific vulnerable versions. Users who view pages with injected scripts could have their sessions hijacked or be redirected to malicious sites.
💻 Affected Systems
- MediaWiki with Apex skin
📦 What is this software?
Apex by Wikimedia
Apex by Wikimedia
Apex by Wikimedia
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator credentials, deface websites, or distribute malware to users viewing compromised pages.
Likely Case
Session hijacking, cookie theft, or redirection to phishing sites for users viewing pages with injected scripts.
If Mitigated
Limited impact if proper input validation and output encoding are implemented, though stored XSS remains dangerous.
🎯 Exploit Status
Requires ability to inject content into pages (typically requires some level of editing permissions).
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: MediaWiki 1.39.9, 1.41.3, or 1.42.2
Vendor Advisory: https://phabricator.wikimedia.org/T368628
Restart Required: No
Instructions:
1. Update MediaWiki to version 1.39.9, 1.41.3, or 1.42.2 or later. 2. Ensure the Apex skin is updated as part of the MediaWiki update. 3. Clear any caches if applicable.
🔧 Temporary Workarounds
Disable Apex skin
allSwitch to a different skin that is not vulnerable
Edit LocalSettings.php and change $wgDefaultSkin to a different skin (e.g., 'vector')
Implement Content Security Policy
allAdd CSP headers to mitigate XSS impact
Add appropriate CSP headers to web server configuration
🧯 If You Can't Patch
- Restrict editing permissions to trusted users only
- Implement web application firewall rules to detect and block XSS payloads
🔍 How to Verify
Check if Vulnerable:
Check MediaWiki version and skin configuration in LocalSettings.phpCheck Version:
Check the bottom of any MediaWiki page for version information or examine LocalSettings.phpVerify Fix Applied:
Verify MediaWiki version is 1.39.9, 1.41.3, 1.42.2 or later and Apex skin is updated📡 Detection & Monitoring
Log Indicators:
- Unusual page edits containing script tags or JavaScript code
- Multiple failed XSS attempts in web server logs
Network Indicators:
- Unexpected outbound connections from user browsers after viewing pages
SIEM Query:
Search for pattern: *<script* in page edit logs or web server access logs