GitStock

starcitizenwiki/mediawiki-extensions-embedvideo · Security

Star Citizen EmbedVideo Extension Stored XSS through wikitext caused by usage of non-reserved data attributes

GHSA ID
GHSA-4j5h-mvj3-m48v
CVE ID
CVE-2025-59839
Severity
high
Published
Updated
CVSS
8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVSS v3
8.6 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Description

Summary

The EmbedVideo extension allows adding arbitrary attributes to an HTML element, allowing for stored XSS through wikitext.

Details

The attributes of an iframe are populated with the value of an unreserved data attribute (data-iframeconfig) that can be set via wikitext: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/ext.embedVideo.videolink.js#L5-L20 Similar code is also present here: https://github.com/StarCitizenWiki/mediawiki-extensions-EmbedVideo/blob/440fb331a84b2050f4cc084c1d31d58a1d1c202d/resources/modules/iframe.js#L139-L155

It is possible to execute JS through attributes like onload or onmouseenter.

PoC

  1. Create a page with the following contents:
<div class="embedvideo-evl" data-iframeconfig='{"onload": "alert(1)"}'>Click me!</div>
<evlplayer></evlplayer>
  1. Click on the "Click me!" text
  2. Click on the "Load video" button below

Impact

Arbitrary HTML can be inserted into the DOM by any user, allowing for JavaScript to be executed.

CWEs

  • CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References

Open GitHub