includes/User.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 terminates validation of a user token upon encountering the first incorrect character, which makes it easier for remote attackers to obtain access via a brute-force attack that relies on timing differences in responses to incorrect token guesses.

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

Updated mediawiki packages fix multiple vulnerabilities :

MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed insertion of escaped CSS values which could pass the CSS validation checks, resulting in XSS (CVE-2013-6451).

Chris from RationalWiki reported that SVG files could be uploaded that include external stylesheets, which could lead to XSS when an XSL was used to include JavaScript (CVE-2013-6452).

During internal review, it was discovered that MediaWiki's SVG sanitization could be bypassed when the XML was considered invalid (CVE-2013-6453).

During internal review, it was discovered that MediaWiki displayed some information about deleted pages in the log API, enhanced RecentChanges, and user watchlists (CVE-2013-6472).

Netanel Rubin from Check Point discovered a remote code execution vulnerability in MediaWiki's thumbnail generation for DjVu files.
Internal review also discovered similar logic in the PdfHandler extension, which could be exploited in a similar way (CVE-2014-1610).

MediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML namespace, in uploaded SVG files. Some client software may use these namespaces in a way that results in XSS. This was fixed by disallowing uploading SVG files using non-whitelisted namespaces (CVE-2014-2242).

MediaWiki before 1.22.3 performs token comparison that may be vulnerable to timing attacks. This was fixed by making token comparison use constant time (CVE-2014-2243).

MediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due to flaw with link handling in api.php. This was fixed such that it won't find links in the middle of api.php links (CVE-2014-2244).

MediaWiki has been updated to version 1.22.3, which fixes these issues, as well as several others.

Also, the mediawiki-ldapauthentication and mediawiki-math extensions have been updated to newer versions that are compatible with MediaWiki 1.22.

Additionally, the mediawiki-graphviz extension has been obsoleted, due to the fact that it is unmaintained upstream and is vulnerable to cross-site scripting attacks.

Note: if you were using the instances feature in these packages to support multiple wiki instances, this feature has now been removed.
You will need to maintain separate wiki instances manually.

- (bug 60771) SECURITY: Disallow uploading SVG files using     non-whitelisted namespaces. Also disallow iframe     elements. User will get an error including the namespace     name if they use a non-whitelisted namespace.

    - (bug 61346) SECURITY: Make token comparison use       constant time. It seems like our token comparison       would be vulnerable to timing attacks. This will take       constant time.

    - (bug 61362) SECURITY: API: Don't find links in the       middle of api.php links.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to its self-reported version number, the instance of MediaWiki running on the remote host is affected by the following vulnerabilities :

  - A cross-site scripting (XSS) vulnerability exists in the     includes/upload/UploadBase.php script due to improper     validation of user-supplied input during the uploading     of an SVG namespace. This allows a remote attacker to     create a specially crafted request to execute arbitrary     script code in a user's browser session within the trust     relationship between the browser and server.
    (CVE-2014-2242)

  - A flaw exists in the includes/User.php script in the     theloadFromSession() function where the validation of     user tokens is terminated upon encountering the first     incorrect character. This allows a remote attacker to     gain access to session tokens using a brute force timing     attack. (CVE-2014-2243)

  - A cross-site scripting (XSS) vulnerability exists in the     includes/api/ApiFormatBase.php script in the     formatHTML() function due to improper validation of     user-supplied input when handling links appended to     api.php. This allows a context-dependent attacker to     create a specially crafted request to execute arbitrary     code in a user's browser session within the trust     relationship between the browser and server.
    (CVE-2014-2244)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
73004	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:057)	Nessus	Mandriva Local Security Checks	high
72917	Fedora 19 : mediawiki-1.21.6-1.fc19 (2014-3344)	Nessus	Fedora Local Security Checks	medium
72916	Fedora 20 : mediawiki-1.21.6-1.fc20 (2014-3338)	Nessus	Fedora Local Security Checks	medium
72878	MediaWiki < 1.19.12 / 1.21.6 / 1.22.3 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2014-2243

critical

Tenable Plugins

critical

high

medium

medium

medium