CVE-2022-29969

What it actually does

Allows cross-site scripting by injecting executable script into rendered RSS output when an attacker-controlled feed is present in the whitelist and link tags are permitted.

Why it matters to the business

Attackers can hijack user sessions, steal credentials, or perform actions on behalf of wiki visitors, leading to data exposure, unauthorized edits, or loss of trust in the platform.

How an attack unfolds

An attacker places malicious JavaScript inside an RSS feed that is already on the MediaWiki RSS whitelist. When a user views content that pulls from this feed, the browser executes the script because link tags are allowed, resulting in client-side compromise without any authentication required from the attacker.

How to fix it

Upgrade the RSS extension to the version released on or after 2022-04-29. If immediate upgrade is not possible, set $wgRSSAllowLinkTag to false or remove untrusted feeds from $wgRSSUrlWhitelist.

How to confirm the fix worked

Confirm the installed RSS extension timestamp is 2022-04-29 or later, verify that $wgRSSAllowLinkTag is disabled, and test rendering of a sample whitelisted feed containing a benign script tag to ensure it is sanitized.

Typical attack path

1. Identify or compromise an RSS feed listed in $wgRSSUrlWhitelist
2. Craft feed entries containing script payloads inside link or other permitted tags
3. Wait for or entice users to load wiki pages that render the malicious feed
4. Execute arbitrary JavaScript in victims' browsers to exfiltrate cookies or perform actions

How to detect it

Inspect web server and MediaWiki access logs for requests that include RSS rendering parameters combined with unexpected HTML or script tags; review recent changes to RSS-related configuration variables and audit any whitelisted external feed sources.

What your security team should do

• Apply the 2022-04-29 or newer RSS extension update immediately across all MediaWiki instances
• Review and minimize the contents of $wgRSSUrlWhitelist to only verified internal feeds
• Disable $wgRSSAllowLinkTag unless a documented business need exists
• Monitor for unusual script execution or cookie exfiltration attempts originating from wiki pages