XSS in Despam action

[Jamie Strandboge]

XSS in Despam page. To reproduce:
1. http://localhost/MyWiki/TestXSS<blink>WARNING</blink>
2. click 'Create new empty page' with text 'Describe TestXSS<blink>WARNING</blink> here.'
3. click Save
4. Login as someone who can Despam (eg, superuser)
5. go to http://localhost/MyWiki/TestXSS%3Cblink%3EWARNING%3C/blink%3E?action=Despam
6. click the appropriate 'Select Author' link (usually the 'localhost' link. If this doesn't work, then login as a non-superuser, make a small edit to the page (eg, remove 'here' from the first line), then log back in as superuser and try to Despam again, clicking 'Select Author' for the user that just made the edit)
7. click 'Revert All!'
8. observe a lot of blinking text (from the pagename)

Versions tested:
1.5.2-1ubuntu2.5 (Dapper)
1.5.8-5.1ubuntu2.3 (Hardy)
1.7.1-1ubuntu1.3 (Intrepid)
1.8.2-2ubuntu2.2 (Jaunty)
1.8.4-1ubuntu1.1 (Karmic)

Affected strings:
Pages to revert: all versions (1.5.x shows it as 'Debug' text)
Begin reverting: all versions
Finished reverting: all versions

Analysis:
The page name is not escaped in the revert_pages() function in Despam.py. It appears only privileged users are allowed to use the Despam action. Since the script must occur in the page name, it is pretty obvious when viewing that the page is suspicious (but this might be why someone was using the Despam action in the first place). There is also a limit on the length of the page name.

This has been assigned CVE-2010-0828.

[Jamie Strandboge (jdstrand)]

moin (1.9.2-2ubuntu2) lucid; urgency=low

  * Debian declares python-werkzeug and python-parsedatetime as Depends and
    python-xappy as Recommends, however these packages are in universe,
    which breaks Ubuntu policy (section 2.2.1). Until these packages can be
    added to main, use the embedded copies in moin.
    - debian/patches/ubuntu_use_embedded_for_main.patch: update setup.py
    - debian/rules: update CDBS_DEPENDS and CDBS_RECOMMENDS for the above
  * SECURITY UPDATE: fix XSS in Despam action
    - debian/patches/CVE-2010-0828.patch: use wikiutil.escape() in
      revert_pages()
    - CVE-2010-0828

[Jamie Strandboge (jdstrand)]

http://www.ubuntu.com/usn/USN-925-1