CVE-2015-2941 in MediaWiki
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/03/2022
The vulnerability described in CVE-2015-2941 represents a critical cross-site scripting flaw affecting MediaWiki installations across multiple version ranges when operating with HHVM runtime environment. This issue stems from inadequate input validation and improper error handling mechanisms within the MediaWiki application's API processing capabilities. The vulnerability specifically manifests when the system encounters malformed wddx format requests sent to the api.php endpoint, creating a pathway for remote attackers to execute malicious scripts within the context of affected user sessions.
The technical root cause of this vulnerability lies in the unsafe handling of wddx_serialize_value function calls within MediaWiki's error message generation process. When an invalid parameter is submitted in a wddx format request, the system fails to properly sanitize or escape the malformed input before incorporating it into error messages displayed to users. This improper input handling creates a classic XSS attack vector where attacker-controlled data can be injected directly into web pages viewed by legitimate users. The vulnerability is particularly concerning because it operates at the API layer, allowing attackers to leverage the application's legitimate interface to deliver malicious payloads without requiring authentication or privileged access.
From an operational impact perspective, this vulnerability exposes MediaWiki installations to significant security risks including session hijacking, credential theft, and data manipulation attacks. Attackers can craft malicious requests that, when processed by affected MediaWiki instances, will execute arbitrary JavaScript code in the browsers of unsuspecting users. This could lead to unauthorized access to user accounts, modification of wiki content, or redirection to malicious websites. The vulnerability affects a wide range of MediaWiki versions including 1.19.23 and earlier, 1.23.8 and earlier, and 1.24.1 and earlier releases, making it particularly impactful given MediaWiki's widespread adoption across educational institutions, corporate environments, and open-source projects. The HHVM-specific nature of the vulnerability indicates that organizations running MediaWiki with this runtime environment face heightened risk compared to those using standard php interpreters.
The security implications of this vulnerability align with CWE-79, which identifies Cross-Site Scripting as a fundamental weakness in web application security. This classification emphasizes the critical nature of input validation and output encoding practices that should prevent malicious code execution in user-facing contexts. From an ATT&CK framework perspective, this vulnerability maps to T1059.007 for Scripting and T1566.001 for Spearphishing Attachment, as attackers can leverage this flaw to deliver malicious scripts through API interactions. Organizations should prioritize immediate patching of affected MediaWiki installations to address this vulnerability, as the attack surface remains significant due to the widespread deployment of vulnerable versions. Additionally, implementing proper input validation at the API layer, output encoding for error messages, and regular security assessments can help mitigate similar vulnerabilities in the future. The incident underscores the importance of maintaining up-to-date software versions and the necessity of comprehensive security testing, particularly for applications that process external input through API endpoints.