CVE-2024-25109: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Published: 2024-02-09T23:15Z
Repository: https://github.com/miraheze/ManageWiki
Language: PHP
Files changed: includes/FormFactory/ManageWikiFormFactoryBuilder.php
Commit date: 2024-02-09 22:04:37 +0100
Commit message: Escape some more interface messages
Diff: diff --git a/includes/FormFactory/ManageWikiFormFactoryBuilder.php b/includes/FormFactory/ManageWikiFormFactoryBuilder.php
index 65703e9..e9973a2 100644
--- a/includes/FormFactory/ManageWikiFormFactoryBuilder.php
+++ b/includes/FormFactory/ManageWikiFormFactoryBuilder.php
@@ -668,20 +668,20 @@ class ManageWikiFormFactoryBuilder {
 		}
 
 		$rowsBuilt = [];
 
 		foreach ( $groupData['allGroups'] as $group ) {
-			$rowsBuilt[UserGroupMembership::getGroupName( $group )] = $group;
+			$rowsBuilt[htmlspecialchars( UserGroupMembership::getGroupName( $group ) )] = $group;
 		}
 
 		$formDescriptor['group-matrix'] = [
 			'type' => 'checkmatrix',
 			'columns' => [
-				wfMessage( 'managewiki-permissions-addall' )->text() => 'wgAddGroups',
-				wfMessage( 'managewiki-permissions-removeall' )->text() => 'wgRemoveGroups',
-				wfMessage( 'managewiki-permissions-addself' )->text() => 'wgGroupsAddToSelf',
-				wfMessage( 'managewiki-permissions-removeself' )->text() => 'wgGroupsRemoveFromSelf'
+				wfMessage( 'managewiki-permissions-addall' )->escaped() => 'wgAddGroups',
+				wfMessage( 'managewiki-permissions-removeall' )->escaped() => 'wgRemoveGroups',
+				wfMessage( 'managewiki-permissions-addself' )->escaped() => 'wgGroupsAddToSelf',
+				wfMessage( 'managewiki-permissions-removeself' )->escaped() => 'wgGroupsRemoveFromSelf'
 			],
 			'rows' => $rowsBuilt,
 			'section' => 'group',
 			'default' => $groupData['groupMatrix'],
 			'disabled' => !$ceMW

Vulnerable code: 			$rowsBuilt[UserGroupMembership::getGroupName( $group )] = $group;
				wfMessage( 'managewiki-permissions-addall' )->text() => 'wgAddGroups',
				wfMessage( 'managewiki-permissions-removeall' )->text() => 'wgRemoveGroups',
				wfMessage( 'managewiki-permissions-addself' )->text() => 'wgGroupsAddToSelf',
				wfMessage( 'managewiki-permissions-removeself' )->text() => 'wgGroupsRemoveFromSelf'
Fixed code: 			$rowsBuilt[htmlspecialchars( UserGroupMembership::getGroupName( $group ) )] = $group;
				wfMessage( 'managewiki-permissions-addall' )->escaped() => 'wgAddGroups',
				wfMessage( 'managewiki-permissions-removeall' )->escaped() => 'wgRemoveGroups',
				wfMessage( 'managewiki-permissions-addself' )->escaped() => 'wgGroupsAddToSelf',
				wfMessage( 'managewiki-permissions-removeself' )->escaped() => 'wgGroupsRemoveFromSelf'