Wikimedia MediaWiki Wikidata Extension Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Wikimedia Foundation's MediaWiki Wikidata Extension, affecting versions 1.39 through 1.43. The issue arises from improper input validation, allowing XSS payloads to be injected via the 'widthheight' message. This vulnerability is exploited through the 'ImageHandler::getDimensionsString()' method, which returns unescaped text that is later used as HTML in the 'CommonsInlineImageFormatter' component.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, set the '$wgUseXssLanguage' variable to true. Then, create a Wikibase entity with an image statement using a property of the 'commonsMedia' data type. Load the entity with the 'uselang=x-xss' parameter. The expected outcome is to see no alerts, but the actual outcome is two 'widthheight' alerts per image, indicating that the vulnerability is present.

Remediation

Users can update to MediaWiki Wikidata Extension versions 1.44.0-wmf.25 or later, where this vulnerability has been fixed.