XSS in big wiki software

Question

I found an XSS vuln at a big wiki software. Here's the vuln code:

<?php
/**
 * Mock load.php with pre-defined test modules.
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License along
 * with this program; if not, write to the Free Software Foundation, Inc.,
 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
 * http://www.gnu.org/copyleft/gpl.html
 *
 * @file
 * @package MediaWiki
 * @author Lupo
 * @since 1.20
 */
header( 'Content-Type: text/javascript; charset=utf-8' );

$moduleImplementations = [
    'testUsesMissing' => "
mw.loader.implement( 'testUsesMissing', function () {
    mw.loader.testFail( 'Module usesMissing script should not run.' );
}, {}, {});
",

    'testUsesNestedMissing' => "
mw.loader.implement( 'testUsesNestedMissing', function () {
    mw.loader.testFail('Module testUsesNestedMissing script should not run.' );
}, {}, {});
",

    'testSkipped' => "
mw.loader.implement( 'testSkipped', function () {
    mw.loader.testFail( false, 'Module testSkipped was supposed to be skipped.' );
}, {}, {});
",

    'testNotSkipped' => "
mw.loader.implement( 'testNotSkipped', function () {}, {}, {});
",

    'testUsesSkippable' => "
mw.loader.implement( 'testUsesSkippable', function () {}, {}, {});
",

    'testUrlInc' => "
mw.loader.implement( 'testUrlInc', function () {} );
",
    'testUrlInc.a' => "
mw.loader.implement( 'testUrlInc.a', function () {} );
",
    'testUrlInc.b' => "
mw.loader.implement( 'testUrlInc.b', function () {} );
",
    'testUrlOrder' => "
mw.loader.implement( 'testUrlOrder', function () {} );
",
    'testUrlOrder.a' => "
mw.loader.implement( 'testUrlOrder.a', function () {} );
",
    'testUrlOrder.b' => "
mw.loader.implement( 'testUrlOrder.b', function () {} );
",
];

$response = '';

// Does not support the full behaviour of ResourceLoaderContext::expandModuleNames(),
// Only supports dotless module names joined by comma,
// with the exception of the hardcoded cases for testUrl*.
if ( isset( $_GET['modules'] ) ) {
    if ( $_GET['modules'] === 'testUrlInc,testUrlIncDump|testUrlInc.a,b' ) {
        $modules = [ 'testUrlInc', 'testUrlIncDump', 'testUrlInc.a', 'testUrlInc.b' ];
    } elseif ( $_GET['modules'] === 'testUrlOrder,testUrlOrderDump|testUrlOrder.a,b' ) {
        $modules = [ 'testUrlOrder', 'testUrlOrderDump', 'testUrlOrder.a', 'testUrlOrder.b' ];
    } else {
        $modules = explode( ',', $_GET['modules'] );
    }
    foreach ( $modules as $module ) {
        if ( isset( $moduleImplementations[$module] ) ) {
            $response .= $moduleImplementations[$module];
        } elseif ( preg_match( '/^test.*Dump$/', $module ) === 1 ) {
            $queryModules = $_GET['modules'];
            $queryVersion = isset( $_GET['version'] ) ? strval( $_GET['version'] ) : null;
            $response .= 'mw.loader.implement( ' . json_encode( $module )
                . ', function ( $, jQuery, require, module ) {'
                . 'module.exports.query = { '
                . 'modules: ' . json_encode( $queryModules ) . ','
                . 'version: ' . json_encode( $queryVersion )
                . ' };'
                . '} );';
        } else {
            // Default
            $response .= 'mw.loader.state(' . json_encode( $module ) . ', "missing" );' . "\n";
        }
    }
}

echo $response;

The output of $_GET["modules"] isnt filtered. Can you tell me if this XSS is vulnerable and also dangerous in your eyes?

Answer 1

This doesn't seem dangerous as the content type isn't HTML:

header( 'Content-Type: text/javascript; charset=utf-8' );

For specifics about XSS and content type text/javascript see eg Reflective XSS in script codes with Content Type “text/javascript”.

_{As an aside, I would suggest to either anonymize the code in the future or to not ask such a question in a public forum. Full disclosure without contacting the vendor first is bad form.}

Answer 2

For reference, the file in question is https://github.com/wikimedia/mediawiki/blob/master/tests/qunit/data/load.mock.php

It's partially protected with a 'Deny from all' .htaccess in the root of the test directory https://github.com/wikimedia/mediawiki/blob/master/tests/.htaccess

Deny from all

Answer 3

If I read this code correctly it is listing the installed modules on the web server. This is a vulnerability but you'd have to be the server admin and have a module with a name like <script>alert('xss');</script> .

However is it an XSS? OWASP defines XSS as :

"Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted websites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it." https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Since this attack would be from an authenticated user on the operating system it would not be an XSS.