TabberNeue MediaWiki Extension Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the TabberNeue MediaWiki extension, specifically in versions prior to 2.7.2. The issue arises in the TabberTransclude.php file, where user-supplied page names are not properly escaped before being output. This flaw allows an XSS payload to be injected and executed. The vulnerability is present in the 'tabbertransclude' hook, which can be exploited by users who can edit pages or render wikitext.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a 'tabbertransclude' element with an unescaped XSS payload, such as a script tag, as the page name. When the tab is rendered, the script will execute, demonstrating the cross-site scripting vulnerability.

Remediation

Users can update to TabberNeue version 2.7.2 or later, where this vulnerability has been fixed.