CVE-2014-7295 in MediaWiki
Summary
by MITRE
The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 02/21/2022
The vulnerability identified as CVE-2014-7295 represents a significant cross-site scripting weakness in MediaWiki software versions prior to specific patch releases. This flaw exists within two critical user interface components: the Special:Preferences page and the Special:UserLogin page, which are fundamental access points for user account management and authentication within the MediaWiki ecosystem. The vulnerability stems from insufficient input validation and output encoding mechanisms that fail to properly sanitize user-provided content before rendering it in web pages. Attackers can exploit this weakness by crafting malicious CSS code and injecting it through the MediaWiki:Common.css page, which serves as a global stylesheet that affects all users of the wiki. The vulnerability specifically affects MediaWiki versions 1.19.20 and earlier, 1.22.x versions before 1.22.12, and 1.23.x versions before 1.23.5, indicating a widespread impact across multiple release branches that were commonly deployed in enterprise and institutional wiki environments.
The technical implementation of this vulnerability allows authenticated users to execute malicious scripts within the context of other users' browsers, creating a persistent XSS attack vector that can be leveraged for session hijacking, credential theft, or redirection to malicious sites. The exploitation mechanism relies on the fact that MediaWiki does not adequately sanitize CSS content submitted through the user preferences interface, particularly when modifying global CSS files that are rendered for all users. This creates a scenario where a compromised user account can inject malicious code that executes whenever other users access the affected pages, potentially affecting thousands of users within a single wiki installation. The vulnerability falls under CWE-79, which specifically addresses cross-site scripting flaws, and aligns with ATT&CK technique T1059.007 for script injection attacks. The impact extends beyond simple XSS execution as the vulnerability can potentially enable privilege escalation attacks when combined with other weaknesses, particularly in environments where administrative users might be tricked into viewing maliciously crafted content.
The operational impact of this vulnerability is substantial for organizations relying on MediaWiki for collaborative documentation, knowledge management, or content publishing. Attackers with access to any authenticated user account can effectively compromise the entire wiki environment by injecting malicious code that affects all users, including administrators. This creates a persistent threat vector that can be exploited for data exfiltration, session manipulation, or redirection to phishing sites that appear legitimate to users. The vulnerability particularly affects institutional wiki deployments where multiple users have access to content management features, as it requires minimal privileges to exploit and can cause widespread disruption. Organizations using MediaWiki in production environments face potential reputational damage, compliance violations, and operational disruption when such vulnerabilities are exploited. The attack surface is particularly broad because the affected pages are commonly accessed by users during routine authentication and preference management activities, making successful exploitation more likely. Security teams must consider this vulnerability as a potential entry point for more sophisticated attacks, especially when combined with other weaknesses in the web application stack or when users are subjected to social engineering campaigns targeting wiki access credentials. The remediation process requires immediate patching of affected MediaWiki installations, along with monitoring for any indicators of exploitation attempts, and implementation of additional security controls such as content security policies to mitigate the impact of similar vulnerabilities in the future.