Wikimedia Foundation MediaWiki Content-Type Misconfiguration Vulnerability in ActionEntryPoint

A vulnerability exists in Wikimedia Foundation MediaWiki versions prior to 1.43.7, 1.44.4, and 1.45.2. The issue arises in the ActionEntryPoint component, where the 'action=raw' request for a 'Special:Mypage' subpage is incorrectly served with a 'Content-Type' of 'text/html' instead of the requested 'text/javascript'. This misconfiguration can be exploited to execute arbitrary JavaScript in the context of the user's session.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the context of the user's session, potentially leading to session hijacking or other malicious actions.

Reproduction

To reproduce this vulnerability, request a 'Special:Mypage' subpage with 'action=raw' and 'ctype=text/javascript'. The response will incorrectly be 'text/html', allowing for the execution of JavaScript if the content is evaluated.

Remediation

Users can update to MediaWiki versions 1.43.7, 1.44.4, or 1.45.2, where this vulnerability has been fixed.