Incomplete blacklist vulnerability in includes/upload/UploadBase.php in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via an application/xml MIME type for a nested SVG with a data: URI.

The version of MediaWiki installed is 1.19.x earlier than 1.19.24, 1.23.x earlier than 1.23.9, or 1.24.x earlier than 1.24.2. Therefore, it is affected by multiple vulnerabilities :

 - A flaw in the 'includes/upload/UploadBase.php' script is triggered when the blacklist feature fails to properly validate nested SVG files due to a missing MIME type blacklist. This may allow a remote attacker to upload SVG files which will execute malicious JavaScript code.
 - A flaw exists that allows a stored cross-site scripting (XSS) attack. This flaw exists because the 'includes/Html.php' script does not validate input during Html class attribute expansion before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw in the 'includes/libs/XmlTypeCheck.php' script. The issue is triggered when the SVG filter assumes that XML is expanded. This may allow a remote attacker to bypass the SVG filter by encoding SVG entities.
 - A flaw in the 'wddx' output format's handling of API errors allows a reflected 1.26.3 attack. This flaw exists because the 'api.php' script does not validate input to the 'submodule' parameter before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw is triggered when hashing PBKDF2 passwords. With a specially crafted overly large password, a remote attacker can cause the operation to take the max execution time, consuming resources.
 - An Xml eXternal Entity (XXE) injection flaw is triggered during the parsing of XML data in SVG or XMP files. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker to consume all system resources, making the web server unresponsive.
 - A quadratic blowup XXE injection flaw is triggered during the parsing of XML data. The issue is due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. By sending specially crafted XML data, a remote attacker can exhaust memory up to the memory_limit set by PHP.
 - A flaw in the 'includes/upload/UploadBase.php' script is triggered when the SVG filter does not adequately protect against certain style declarations. This may allow a remote attacker to bypass the SVG filter.
 - A flaw exists that allows a stored 1.26.3 attack. This flaw exists because the program does not validate during custom JavaScript previews before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - A flaw exists in the 'includes/upload/UploadBase.php' script. The issue is due to the check for animating an element's href to a JavaScript URL being insufficient. This may allow a remote attacker to bypass the blacklist filter.
 - Scribunto Extension contains a flaw that allows a stored 1.26.3 attack. This flaw exists because the 'Lua Error Backtraces' function in the 'engines/LuaCommon/LuaCommon.php' script does not validate input when handling names before returning it to users. This may allow a remote attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.
 - CheckUser Extension contains a flaw as user rights are not properly checked when handling HTTP requests to 'specials/SpecialCheckUser.php' that do not require multiple steps, explicit confirmation, or a unique token when performing certain sensitive actions. By tricking a user into following a specially crafted link, a context-dependent attacker can perform a Cross-Site Request Forgery (CSRF / XSRF) attack causing the victim to have their reputation damaged or their logs flooded.
 - A flaw exists that allows a 1.26.3 attack. This flaw exists because the program does not validate input encoded entities in SVG files before returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server.

The remote host is affected by the vulnerability described in GLSA-201510-05 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker may be able to create a Denial of Service condition,       obtain sensitive information, bypass security restrictions, and inject       arbitrary web script or HTML.
  Workaround :

    There is no known workaround at this time.

According to its version number, the MediaWiki application running on the remote host is affected by the following vulnerabilities :

  - An input validation error exists related to handling     API errors that allows reflected cross-site scripting     attacks. (CVE-2014-9714, CVE-2015-2941)

  - An input validation error exists related to SVG file     uploads that allows stored cross-site scripting attacks     by bypassing a missing MIME type blacklist.
    (CVE-2015-2931)

  - An input validation error exists related to the handling     of JavaScript used to animate elements in the     'includes/upload/UploadBase.php' script that allows a     remote attacker to bypass the blacklist filter.
    (CVE-2015-2932)

  - An input validation error exists in the     'includes/Html.php' script that allows stored cross-site     scripting attacks. (CVE-2015-2933)

  - A flaw in the 'includes/libs/XmlTypeCheck.php' script     allows a remote attacker to bypass the SVG filter by     encoding SVG entities. (CVE-2015-2934)

  - A flaw in the 'includes/upload/UploadBase.php' script     allows a remote attacker to bypass the SVG filter and     de-anonymize the wiki readers. This issue exists due to     an incomplete fix for CVE-2014-7199. (CVE-2015-2935)

  - A denial of service vulnerability exists due to a flaw     in the handling of hashing large PBKDF2 passwords.
    (CVE-2015-2936)

  - A denial of service vulnerability exists due to an XML     external entity injection (XXE) flaw that is triggered     by the parsing of crafted XML data. (CVE-2015-2937)

  - An input validation error exists related to the     user-supplied custom JavaScript that allows stored     cross-site scripting attacks. (CVE-2015-2938)

  - An input validation error exists related to the     Scribunto extension that allows stored cross-site     scripting attacks. (CVE-2015-2939)

  - A flaw in the CheckUser extension allows cross-site     request forgery attacks due to a flaw in which user     rights are not properly checked. (CVE-2015-2940)

  - A denial of service vulnerability exists due to an     XML external entity (XXE) injection flaw triggered by     the parsing of crafted XML data in SVG or XMP files.
    (CVE-2015-2942)

  - A cross-site scripting vulnerability exists due to     improper validation of input encoded entities in SVG     files. An unauthenticated, remote attacker can exploit     this, via a specially crafted request, to execute     arbitrary script code in a user's browser session.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated mediawiki packages fix security vulnerabilities :

In MediaWiki before 1.23.9, one could circumvent the SVG MIME blacklist for embedded resources. This allowed an attacker to embed JavaScript in the SVG (CVE-2015-2931).

In MediaWiki before 1.23.9, the SVG filter to prevent injecting JavaScript using animate elements was incorrect (CVE-2015-2932).

In MediaWiki before 1.23.9, a stored XSS vulnerability exists due to the way attributes were expanded in MediaWiki's Html class, in combination with LanguageConverter substitutions (CVE-2015-2933).

In MediaWiki before 1.23.9, MediaWiki's SVG filtering could be bypassed with entity encoding under the Zend interpreter. This could be used to inject JavaScript (CVE-2015-2934).

In MediaWiki before 1.23.9, one could bypass the style filtering for SVG files to load external resources. This could violate the anonymity of users viewing the SVG (CVE-2015-2935).

In MediaWiki before 1.23.9, MediaWiki versions using PBKDF2 for password hashing (not the default for 1.23) are vulnerable to DoS attacks using extremely long passwords (CVE-2015-2936).

In MediaWiki before 1.23.9, MediaWiki is vulnerable to Quadratic Blowup DoS attacks, under both HHVM and Zend PHP (CVE-2015-2937).

In MediaWiki before 1.23.9, the MediaWiki feature allowing a user to preview another user's custom JavaScript could be abused for privilege escalation (CVE-2015-2938).

In MediaWiki before 1.23.9, function names were not sanitized in Lua error backtraces, which could lead to XSS (CVE-2015-2939).

In MediaWiki before 1.23.9, the CheckUser extension did not prevent CSRF attacks on the form allowing checkusers to look up sensitive information about other users. Since the use of CheckUser is logged, the CSRF could be abused to defame a trusted user or flood the logs with noise (CVE-2015-2940).

The mediawiki package has been updated to version 1.23.9, fixing these issues and other bugs.

ID	Name	Product	Family	Severity
9471	MediaWiki < 1.19.24 / 1.23.9 / 1.24.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	medium
86690	GLSA-201510-05 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
84164	MediaWiki < 1.19.24 / 1.23.9 / 1.24.2 Multiple Vulnerabilities	Nessus	CGI abuses	medium
82686	Mandriva Linux Security Advisory : mediawiki (MDVSA-2015:200)	Nessus	Mandriva Local Security Checks	high

Detections

Analytics

CVE-2015-2931

high

Tenable Plugins

medium

high

medium

high