Bug 1826076 (CVE-2020-10960)

Summary:	CVE-2020-10960 mediawiki: makeCollapsible allows applying event handler to any CSS selector
Product:	[Other] Security Response	Reporter:	Guilherme de Almeida Suckevicz <gsuckevi>
Component:	vulnerability	Assignee:	Nobody <nobody>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aos-bugs, Axel.Thimm, bmontgom, eparis, jburrell, mike, nstielau, shurley, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in MediaWiki, where many CSS stylesheets were applied freely to user Wiki pages. This flaw allows an attacker with the ability to create Wiki pages to hide HTML elements that they should not have access permissions to control.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1826081, 1827448, 1827449
Bug Blocks:	1826083

Description Guilherme de Almeida Suckevicz 2020-04-20 19:55:15 UTC

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).

References:
https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.html
https://phabricator.wikimedia.org/T246602

Comment 1 Guilherme de Almeida Suckevicz 2020-04-20 20:04:13 UTC

Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1826081]

Comment 2 Jason Shepherd 2020-04-24 00:04:01 UTC

Statement:

The MediaWiki Ansible Playbook has been removed from OpenShift Container Platform in the 4.3 release.