CVE-2014-2242: XSS
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Other sources
The MediaWiki 1.22.3, 1.21.6 and 1.19.12 release announcement notes:
(bug 60771) SECURITY: Disallow uploading SVG files using non-whitelisted namespaces. Also disallow iframe elements. User will get an error including the namespace name if they use a non- whitelisted namespace.
An attacker could perform cross-site scripting attacks by uploading crafted SVG images.
The versions of MediaWiki in Fedora and EPEL 6 are affected. I have not tested EPEL 5.
References: http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html https://bugzilla.wikimedia.org/showbug.cgi?id=60771 https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mediawikito a version that resolves this vulnerability.Fixed in 1.22.3 - Upgrade
Upgrade
redhat/mediawikito a version that resolves this vulnerability.Fixed in 1.21.6 - Upgrade
Upgrade
redhat/mediawikito a version that resolves this vulnerability.Fixed in 1.19.12 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.22.3 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.21.6 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.19.12 - Configuration
Update MediaWiki’s SVG upload handling so that uploads reject any SVG namespace not in the whitelist (the issue affects versions prior to 1.19.12, 1.20.x, and 1.21.x before 1.21.6, and 1.22.x before 1.22.3).
MediaWiki (SVG uploads) SVG namespace whitelist = Disallow uploading SVG files using non-whitelisted namespaces - Configuration
Ensure MediaWiki rejects SVG files containing iframe elements (XSS demonstrated via an IFRAME element combined with a non-whitelisted namespace).
MediaWiki (SVG uploads) SVG iframe elements = Disallow <iframe> elements
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2242?
CVE-2014-2242 is classified as a high severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2014-2242?
To fix CVE-2014-2242, upgrade MediaWiki to version 1.19.12, 1.21.6, 1.22.3, or later.
Which MediaWiki versions are affected by CVE-2014-2242?
CVE-2014-2242 affects MediaWiki versions prior to 1.19.12, 1.21.6, and 1.22.3.
Can CVE-2014-2242 be exploited through SVG files?
Yes, CVE-2014-2242 allows remote attackers to exploit the vulnerability by uploading malicious SVG files.
What type of attack does CVE-2014-2242 facilitate?
CVE-2014-2242 facilitates cross-site scripting (XSS) attacks through improper handling of SVG uploads.