MediaWiki SVG cross-site scripting vulnerability
Description
MediaWiki, the open-source wiki platform powering Wikipedia, contains a cross-site scripting (XSS) vulnerability in its SVG file handling mechanism. The vulnerability occurs when MediaWiki fails to properly sanitize encoded XML entities within SVG files, allowing attackers to embed malicious JavaScript code that executes when users view the SVG content. This affects MediaWiki installations that permit SVG file uploads and rendering.
Remediation
Take the following steps to remediate this vulnerability:
1. Upgrade MediaWiki immediately:
Update to MediaWiki version 1.24.2 or later, which includes fixes for this SVG XSS vulnerability. Download the latest stable release from the official MediaWiki website.
2. Review uploaded SVG files:
Audit existing SVG files in your MediaWiki installation for potentially malicious content, particularly those containing XML entities or embedded scripts.
3. Implement additional security controls:
• Configure Content Security Policy (CSP) headers to restrict script execution
• Consider disabling SVG uploads if not required for your use case
• Restrict file upload permissions to trusted users only
• Enable MediaWiki's built-in file upload restrictions in LocalSettings.php
4. Verify the fix:
After upgrading, test SVG file uploads with sample files containing script tags to confirm proper sanitization is occurring.