Bug 1903752 (CVE-2020-26120) - CVE-2020-26120 mediawiki: XSS exists in the MobileFrontend extension
Summary: CVE-2020-26120 mediawiki: XSS exists in the MobileFrontend extension
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-26120
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1903753
Blocks: 1903781
TreeView+ depends on / blocked
 
Reported: 2020-12-02 18:16 UTC by Dhananjay Arunesh
Modified: 2021-02-16 18:47 UTC (History)
11 users (show)

Fixed In Version: mediawiki-1.34.4
Clone Of:
Environment:
Last Closed: 2020-12-07 17:02:40 UTC
Embargoed:

Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-12-02 18:16:47 UTC 
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.

References:
https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea
https://phabricator.wikimedia.org/T262213
Comment 1 Dhananjay Arunesh 2020-12-02 18:17:13 UTC 
Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 1903753]
Comment 2 Przemyslaw Roguski 2020-12-07 14:37:25 UTC 
Upstream commit:
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/MobileFrontend/+/626695
Comment 4 Przemyslaw Roguski 2020-12-07 14:37:32 UTC 
External References:

https://phabricator.wikimedia.org/T262213
Comment 5 Przemyslaw Roguski 2020-12-07 14:48:53 UTC 
The vulnerability is directly related to MobileFrontent Extension, which is not bundled in the OpenShift mediawiki package.
Comment 6 Przemyslaw Roguski 2020-12-07 16:48:34 UTC 
Statement:

OpenShift Container Platform (OCP)  delivers the mediawiki package, but the vulnerable code is not bundled, therefore OCP is not affected by this flaw.
Comment 7 Product Security DevOps Team 2020-12-07 17:02:40 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-26120
Note You need to log in before you can comment on or make changes to this bug.