GHSA-v65j-hff3-753c: XSS
Summary With $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection.
Details The iframe assembled here adds the url from getUrl() as the src without sanitization. The id regex for the archiveorg service and the url regexes for the wistia and sharepoint services allow for double quotes to be introduced.
PoC Using double quotes, the src attribute can be escaped. <embedvideo service="archiveorg" id='a" onmouseover="alert(document.domain)" data-x="'></embedvideo>
Impact When $wgEmbedVideoRequireConsent = false, any user able to edit a page can inject arbitrary JavaScript into an HTML event handler attribute (e.g. onfocus) via parameter. It requires no interaction (autofires via autofocus) and executes in the wiki origin for every visitor to the page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/starcitizenwiki/embedvideoto a version that resolves this vulnerability.Fixed in 4.1.0 - Configuration
Enable embed-video consent by setting $wgEmbedVideoRequireConsent to true; the vulnerability is exposed when this setting is false or disabled.
MediaWiki EmbedVideo $wgEmbedVideoRequireConsent = true
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed only when $wgEmbedVideoRequireConsent is set to false; this is not the default configuration. The affected software is composer/starcitizenwiki/embedvideo.
What level of access does an attacker need?
An attacker needs the ability to edit a wiki page and add an embedvideo tag using a vulnerable service input. No authentication or user interaction is required beyond the attacker’s page-editing capability.
Which embed services are identified as accepting the malicious input?
The advisory identifies the archiveorg service ID validation and the wistia and sharepoint URL validation as allowing double quotes that can escape the iframe src attribute.
How can I determine whether exploitation may already have occurred?
Review editable wiki pages for embedvideo tags using archiveorg, wistia, or sharepoint inputs containing double quotes or unexpected HTML attributes, particularly event handlers such as onmouseover or onfocus and autofocus. Pages with such content could execute JavaScript in the wiki origin for visitors.
What is the risk to visitors of an affected page?
Injected JavaScript executes in the wiki’s origin for every visitor to the affected page. The advisory states that an autofocus-based payload can execute without visitor interaction.