GitHub Advisoryadvisory · Packagist

GHSA-62r2-gcxr-426x starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

MEDIUM Published 2024-09-30 Modified 2024-09-30 Official page ↗
Aliases
CVE-2024-47536
Ecosystem
Packagist
Packages
starcitizentools/citizen-skin
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Weaknesses
CWE-79, CWE-80
Reviewed
2024-09-30

Affected packages

• Packagist starcitizentools/citizen-skin: >= 2.6.3, < 2.31.0 → fixed in 2.31.0

Description

Summary A user with the `editmyprivateinfo` right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. Details Here's the offending line: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137 This was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c PoC 1. Login 2. Go to Special:Preferences 3. Set the real name field to a string like `alert("Admin with a propensity for self-XSSes")` 4. Save your settings and use Citizen if it's not being used already Impact Any user who can change their name (whether it's through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only.

Related

Alias · CVE (1)

  • CVE-2024-47536 Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. vulnerability

Weakness · CWE (2)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness
  • CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page weakness

References