Bug 1903752 (CVE-2020-26120)

Summary:	CVE-2020-26120 mediawiki: XSS exists in the MobileFrontend extension
Product:	[Other] Security Response	Reporter:	Dhananjay Arunesh <darunesh>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aos-bugs, Axel.Thimm, bmontgom, eparis, jburrell, jokerman, mike, nstielau, puiterwijk, shurley, sponnaga
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mediawiki-1.34.4	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-12-07 17:02:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1903753
Bug Blocks:	1903781

Description Dhananjay Arunesh 2020-12-02 18:16:47 UTC

XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

References:
https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea
https://phabricator.wikimedia.org/T262213

Comment 1 Dhananjay Arunesh 2020-12-02 18:17:13 UTC

Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1903753]

Comment 2 Przemyslaw Roguski 2020-12-07 14:37:25 UTC

Upstream commit:
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MobileFrontend/+/626695

Comment 4 Przemyslaw Roguski 2020-12-07 14:37:32 UTC

External References:

https://phabricator.wikimedia.org/T262213

Comment 5 Przemyslaw Roguski 2020-12-07 14:48:53 UTC

The vulnerability is directly related to MobileFrontent Extension, which is not bundled in the OpenShift mediawiki package.

Comment 6 Przemyslaw Roguski 2020-12-07 16:48:34 UTC

Statement:

OpenShift Container Platform (OCP)  delivers the mediawiki package, but the vulnerable code is not bundled, therefore OCP is not affected by this flaw.

Comment 7 Product Security DevOps Team 2020-12-07 17:02:40 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-26120