Summary
Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page.
Details
The description provided by the user via the {{SHORTDESC:}} parser function is insufficiently sanitized by the sanitize() function, as html entities are decoded:
|
public function sanitize( $shortDesc ) { |
|
// Remove accidental formatting - descriptions are plaintext. |
|
$shortDesc = strip_tags( $shortDesc ); |
|
// Unescape - clients are not necessarily HTML-based and using HTML tags as part of |
|
// the descript (i.e. with <nowiki> or such) should be possible. |
|
$shortDesc = html_entity_decode( $shortDesc, ENT_QUOTES, 'utf-8' ); |
|
// Remove newlines, tabs and other weird whitespace |
|
$shortDesc = preg_replace( '/\s+/', ' ', $shortDesc ); |
|
// Get rid of leading/trailing space - no valid usecase for it, easy for it to go unnoticed |
|
// in HTML, and clients might display the description in an environment that does not |
|
// ignore spaces like HTML does. |
|
return trim( $shortDesc ); |
|
} |
Via JS, the short description is then passed to
mw.util.addSubtitle, which inserts it as raw HTML:
|
mw.util.addSubtitle( shortdesc ); |
https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563
PoC
- Enable ShortDescription
- Make sure
$wgShortDescriptionEnableTagline is set to true (this is the default)
- Create a page and insert the following wikitext:
{{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}}
- Visit the page
Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.
SomeMWDev Reporter
Summary
Short descriptions are not properly sanitized by the ShortDescription before being inserted as HTML using
mw.util.addSubtitle, allowing any user to insert arbitrary HTML into the DOM by editing a page.Details
The description provided by the user via the
{{SHORTDESC:}}parser function is insufficiently sanitized by thesanitize()function, as html entities are decoded:mediawiki-extensions-ShortDescription/includes/Hooks/ParserHooks.php
Lines 147 to 159 in 7244b1e
Via JS, the short description is then passed to
mw.util.addSubtitle, which inserts it as raw HTML:mediawiki-extensions-ShortDescription/modules/ext.shortDescription.js
Line 8 in 7244b1e
https://github.com/wikimedia/mediawiki/blob/96372101b3c579d9992e8a31a3ccd90a937cac47/resources/src/mediawiki.util/util.js#L552-L563
PoC
$wgShortDescriptionEnableTaglineis set totrue(this is the default){{SHORTDESC:<img src="" onerror="alert('shortdescription xss')">}}Impact
Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.