Cloudanix VulnDB

CVE-2024-34507

High · 7.4

CVSS

7.4

EPSS

0.7%

Published

May 5, 2024

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in wiki software lets attackers run harmful code in visitors' browsers when they look at recent activity pages, risking stolen login details or unwanted actions.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
Application
Class
XSS
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The vulnerability allows cross-site scripting by failing to sanitize the 0x1b escape character in comment content, enabling script execution in the context of Special:RecentChanges and similar pages when rendered in a victim's browser.

Why it matters to the business

Attackers can hijack user sessions, steal sensitive data displayed on wiki pages, or perform actions on behalf of logged-in users, potentially leading to unauthorized content changes or data exposure in collaborative wiki environments.

How an attack unfolds

An attacker crafts a malicious payload containing the 0x1b character and injects it via a comment or URL targeting Special:RecentChanges. When an authenticated user views the affected page, the browser executes the injected script due to improper sanitization, allowing session hijacking or data theft without further user interaction.

How to fix it

Upgrade MediaWiki to version 1.39.7 or later, 1.40.3 or later, or 1.41.1 or later. Apply the patch from commit 3324d89080922a0853b23e0019ad3a48a4ff389a if using a development or custom build. Sanitize all comment output to strip or encode control characters including 0x1b.

How to confirm the fix worked

Confirm the installed version is at or above the fixed releases, test that Special:RecentChanges properly encodes or rejects payloads containing 0x1b, and review release notes or commit history for the sanitization changes.

Typical attack path

  1. Identify a MediaWiki instance running an unpatched version
  2. Craft a URL or comment containing the 0x1b character that bypasses output encoding
  3. Trick a user into visiting Special:RecentChanges or a page displaying the malformed comment
  4. Execute arbitrary JavaScript in the victim's browser session

How to detect it

Inspect web server access logs for requests to Special:RecentChanges containing encoded 0x1b sequences, review comment history for entries with unusual control characters, and check browser console or security event logs for unexpected script execution on wiki pages.

What your security team should do

  • Prioritize upgrade of all MediaWiki instances to the fixed versions immediately
  • Review and restrict public comment submission if patching is delayed
  • Monitor web application firewall rules for suspicious RecentChanges requests
  • Audit recent changes logs for anomalous entries after upgrade

The record

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami mediawiki 0 1.41.1
Debian:12 mediawiki 0 1:1.39.7-1~deb12u1
Debian:13 mediawiki 0 1:1.39.7-1
Ubuntu:18.04:LTS mediawiki 0 No fix
Ubuntu:20.04:LTS mediawiki 0 No fix
Ubuntu:22.04:LTS mediawiki 0 No fix
Ubuntu:24.04:LTS mediawiki 0 1:1.39.7-1
Ubuntu:24.10 mediawiki 0 1:1.39.7-1
Ubuntu:Pro:18.04:LTS mediawiki 0 No fix
Ubuntu:Pro:20.04:LTS mediawiki 0 No fix

Related vulnerabilities