GHSA-62r2-gcxr-426x | starcitizentools/mediawiki-skins-citizen Security

GHSA ID: GHSA-62r2-gcxr-426x
CVE ID: CVE-2024-47536
Severity: medium
Published: 2024-09-30T17:48:33Z
Updated: 2024-09-30T20:11:50Z
CVSS: 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v3: 4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CVSS v4: 4.8 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Description

Summary

A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload.

Details

Here's the offending line: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137

This was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c

PoC

Login
Go to Special:Preferences
Set the real name field to a string like <script>alert("Admin with a propensity for self-XSSes")</script>
Save your settings and use Citizen if it's not being used already

Impact

Any user who can change their name (whether it's through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only.

CWEs

CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

References

Open GitHub