Headline
GHSA-p85q-mww9-gwqf: Citizen Short Description stored XSS vulnerability through wikitext
Summary
Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page.
Details
The description provided by the user via the {{SHORTDESC:}} parser function is insufficiently sanitized by the sanitize() function, as html entities are decoded:
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/includes/Hooks/ParserHooks.php#L147-L159
Via JS, the short description is then passed to mw.util.addSubtitle, which inserts it as raw HTML:
https://github.com/StarCitizenTools/mediawiki-extensions-ShortDescription/blob/7244b1e8b5cb6dbd7e546c5be7fed8a56e33d065/modules/ext.shortDescription.js#L8
https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563
PoC
- Enable ShortDescription
- Make sure
$wgShortDescriptionEnableTaglineis set totrue(this is the default) - Create a page and insert the following wikitext:
{{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}} - Visit the page
Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.