CVE-2024-23176: MediaWiki MassMessage Extension XSS Flaw

CVE-2024-23176 Overview

CVE-2024-23176 is a cross-site scripting (XSS) vulnerability [CWE-79] in the MassMessage extension for MediaWiki. Versions prior to MediaWiki 1.40.2 are affected. The flaw resides in the massmessage-form-page-help internationalization (i18n) key, which is rendered without adequate sanitization when the Special:MassMessage page is loaded with the uselang=x-xss query parameter. An attacker who convinces an authenticated user to visit a crafted URL can execute arbitrary JavaScript in the victim's browser session against the MediaWiki origin.

Critical Impact
Successful exploitation enables script execution in a victim's authenticated MediaWiki session, exposing session tokens, editable pages, and administrative actions to hijack.

Affected Products

MediaWiki MassMessage extension bundled with MediaWiki versions before 1.40.2
MediaWiki core installations using the MassMessage extension on the Special:MassMessage page
Wikimedia-hosted and self-hosted wikis relying on the affected i18n key massmessage-form-page-help

Discovery Timeline

2026-09-14 - CVE-2024-23176 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2024-23176

Vulnerability Analysis

The MassMessage extension exposes the Special:MassMessage special page for bulk-message distribution across wiki pages. MediaWiki supports a debugging language code, x-xss, that wraps localized messages with markers intended to help developers audit output escaping. When the massmessage-form-page-help message is emitted inside the special page, the wrapper output is treated as raw HTML rather than escaped text. An attacker builds a URL such as Special:MassMessage?uselang=x-xss and lures an authenticated user into loading it, causing browser execution of the attacker-controlled payload injected through the i18n key wrapper.

Root Cause

The root cause is improper output encoding of a localization message before insertion into the DOM. The massmessage-form-page-help key is rendered without HTML-context escaping, so the marker characters produced by the x-xss language mode are not neutralized. Any attribute or content emitted through this pathway is interpreted by the browser as executable markup.

Attack Vector

Exploitation requires an authenticated MediaWiki user with permission to reach Special:MassMessage and user interaction to click a crafted link. The attack traverses the network and executes in the victim's browser under the wiki's origin. Impact scope changes because injected script runs against a trusted origin, potentially exposing session cookies, CSRF tokens, and content the victim can modify. See the Wikimedia Phabricator Task #347742 and the Wikimedia Announce Message for the upstream fix reference.

No public proof-of-concept exploit is listed for this CVE. The vulnerability manifests through the uselang=x-xss query parameter interacting with the unsanitized massmessage-form-page-help message, and the fix in MediaWiki 1.40.2 restores proper HTML escaping on that i18n key.

Detection Methods for CVE-2024-23176

Indicators of Compromise

HTTP request logs containing Special:MassMessage combined with the uselang=x-xss query parameter
Referer headers pointing to external domains that redirect users toward Special:MassMessage URLs
Unexpected client-side script execution or DOM modifications reported by users on MassMessage pages

Detection Strategies

Parse MediaWiki access logs for query strings containing uselang=x-xss or other non-production language codes on Special:MassMessage
Deploy Content Security Policy (CSP) reporting endpoints to capture inline script violations originating from the special page
Correlate anomalous session activity, such as unexpected edits or privilege use, with prior visits to crafted Special:MassMessage URLs

Monitoring Recommendations

Alert on inbound URLs that combine special pages with debug language codes (x-xss, qqx) from untrusted referers
Track version metadata across MediaWiki instances to identify hosts still running MassMessage builds older than the fixed version
Enable web application firewall (WAF) rules that log or block uselang values outside the site's supported locale set

How to Mitigate CVE-2024-23176

Immediate Actions Required

Upgrade MediaWiki to version 1.40.2 or later, which ships the patched MassMessage extension
Restrict access to Special:MassMessage to trusted user groups until patching is complete
Enforce a strict Content Security Policy that blocks inline scripts on wiki pages

Patch Information

MediaWiki 1.40.2 corrects the escaping of the massmessage-form-page-help message so that language-mode wrappers no longer produce executable HTML. Administrators should apply the upstream release referenced in the Wikimedia Announce Message. Wikimedia's tracking is available in Phabricator Task #347742.

Workarounds

Disable the MassMessage extension in LocalSettings.php until the upgrade is applied
Configure a WAF rule to strip or reject any uselang=x-xss parameter on requests to Special:MassMessage
Limit the massmessage user right so only vetted administrators can reach the vulnerable special page

bash

# Configuration example: block the x-xss debug language on Special:MassMessage
# Example ModSecurity rule
SecRule REQUEST_URI "@contains Special:MassMessage" \
  "chain,deny,status:403,id:1002317,msg:'Block MassMessage XSS debug lang (CVE-2024-23176)'"
  SecRule ARGS:uselang "@rx ^x-xss$" "t:lowercase"